Arbitrary code execution in Apache ServiceComb java-chassis

2022-02-0922:19:00

Google

osv.dev

0.001 Low

EPSS

Percentile

26.1%

JSON

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution.
The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

CPENameOperatorVersion
org.apache.servicecomb:java-chassiseq1.2.1
org.apache.servicecomb:java-chassiseq2.0.0
org.apache.servicecomb:java-chassiseq2.1.3
org.apache.servicecomb:java-chassiseq2.1.0
org.apache.servicecomb:java-chassiseq2.1.2
org.apache.servicecomb:java-chassiseq1.3.1
org.apache.servicecomb:java-chassiseq1.0.0
org.apache.servicecomb:java-chassiseq2.0.1
org.apache.servicecomb:java-chassiseq2.0.2
org.apache.servicecomb:java-chassiseq2.1.1

Name	Operator	Version
org.apache.servicecomb:java-chassis	eq	1.2.1
org.apache.servicecomb:java-chassis	eq	2.0.0
org.apache.servicecomb:java-chassis	eq	2.1.3
org.apache.servicecomb:java-chassis	eq	2.1.0
org.apache.servicecomb:java-chassis	eq	2.1.2
org.apache.servicecomb:java-chassis	eq	1.3.1
org.apache.servicecomb:java-chassis	eq	1.0.0
org.apache.servicecomb:java-chassis	eq	2.0.1
org.apache.servicecomb:java-chassis	eq	2.0.2
org.apache.servicecomb:java-chassis	eq	2.1.1