Description

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T13:17:38.333Z",
  "pubdate": "2026-08-14T13:17:38.333Z",
  "executiveSummary": "A critical vulnerability involving insecure deserialization has been identified in alldatacenter alldata up to version 0.6.8. The security flaw specifically resides within the Hessian2Input.readObject function located in the /serialize/impl/HessianSerializer.java file of the xxl-rpc Listener component. This vulnerability allows remote attackers to execute arbitrary code or cause other malicious impacts by manipulating serialized data structures processed by the application. The severity of the risk is significantly elevated due to the public availability of exploits targeting this weakness. Furthermore, the project maintainers have closed the issue report as not planned without providing a patch or further explanation, leaving deployments exposed to ongoing threats. Remote threat actors possessing network access to the vulnerable xxl-rpc Listener component can exploit this flaw without prior authentication or high-level privileges, leading to potential full system compromise, data exfiltration, or denial of service depending on the environmental context and available gadget chains within the classpath.",
  "technicalDetails": "The vulnerability stems from improper handling of object deserialization within the xxl-rpc Listener component of alldatacenter alldata up to version 0.6.8. Specifically, the flaw is rooted in the Hessian2Input.readObject method implemented in the /serialize/impl/HessianSerializer.java source file. Deserialization vulnerabilities occur when untrusted data is systematically reconstructed into complex object graphs without adequate validation, type checking, or sanitization of the input stream.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the xxl-rpc Listener component exposed over the network. Exploitation does not require authentication or elevated privileges, lowering the barrier to entry for malicious actors. An attacker initiates the attack flow by crafting a malicious serialized payload utilizing the Hessian protocol format. This crafted payload incorporates specific object gadget chains designed to trigger arbitrary code execution or unintended behaviors during the instantiation process executed by Hessian2Input.readObject.\nOnce the network listener receives the malicious input stream, the HessianSerializer passes the raw bytes to the vulnerable Hessian2Input.readObject function. As the deserialization engine processes the stream, it instantiates the classes specified within the payload and invokes internal methods, such as constructors, readObject custom deserialization routines, or getter/setter methods. If the application's classpath contains vulnerable third-party libraries or gadget chains, the execution flow can be hijacked to perform unauthorized actions on the underlying host operating system.\nThe post-exploitation impact includes remote code execution under the privileges of the process running the xxl-rpc Listener component. Because the project closed the issue report as not planned, no official vendor patch or updated version is currently available to remediate this specific code path in the affected component."
}