Apache EventMesh Hessian Deserialization Vulnerability in eventmesh-meta-raft Plugin Allowing Remote Code Execution

A deserialization vulnerability has been identified in the eventmesh-meta-raft plugin of Apache EventMesh, specifically in the master branch without a released version. This vulnerability is present on Windows, Linux, and macOS platforms. It allows attackers to send controlled messages that can be executed remotely, exploiting Hessian deserialization through the RPC protocol.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Apache EventMesh is running.

Remediation

Users can upgrade to Apache EventMesh version 1.11.0-release or use the code available in the master branch of the project repository to address this vulnerability.