Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-43297 Vulnerability Description There is a poten...

CVE-2021-43297

creationtimestamp| type| source ---|---|--- 2022-01-14 07:16:47+00:00| published-proof-of-concept| https://t.me/cKure/8569 2022-01-17 12:28:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1350 2022-01-17 17:57:12+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1352...

cn.fossc.polaris.framework:basic-framework-spring-boot-starter (>=3.0.9 <=3.0.33), cn.fossc.polaris.framework:polaris-framework-boot (>=3.0.1 <=3.0.33) +40 more potentially affected by CVE-2021-43297 via org.apache.dubbo:dubbo (>=3.0.0 <=3.0.4)

org.apache.dubbo:dubbo MAVEN version =3.0.0, =3.0.9, =3.0.1, =3.0.1, =3.0.1, =1.2.1, =1.6.0, =1.6.1 - com.github.shijingsh:common-dubbo-nacos =1.6.1 - com.github.shijingsh:common-web =1.6.1 and more Source cves: CVE-2021-43297 Source advisory: OSV:GHSA-VP5X-3V8R-QPRWhttps://vulner...

cc.jweb:jweb-adai (>=1.0.2 <=1.0.6), cc.jweb:jweb-boot (>=1.0.2 <=1.0.5) +74 more potentially affected by CVE-2021-43297 via org.apache.dubbo:dubbo (>=2.7.0 <=2.7.14)

org.apache.dubbo:dubbo MAVEN version =2.7.0, =1.0.2, =1.0.2, =1.2.1, =1.28.0, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =0.0.1, =1.0.3, =1.0.3, =1.5.1, =2.0.1, =2.0.11 and more Source cves: CVE-2021-43297 Source advisory: OSV:GHSA-VP5X-3V8R-QPRW...

CVE-2021-43297 Dubbo Hessian cause RCE when parse error

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some...

CVE-2021-43297

CVE-2021-43297 describes a deserialization vulnerability in dubbo Hessian-Lite 3.2.11 and earlier that could enable remote code execution when Hessian mishandles deserialization. Affected are Apache Dubbo versions: 2.6.x before 2.6.12, 2.7.x before 2.7.15, and 3.0.x before 3.0.5. The root cause i...