Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-43297 Vulnerability Description There is a poten...

CVE-2021-43297

creationtimestamp| type| source ---|---|--- 2022-01-14 07:16:47+00:00| published-proof-of-concept| https://t.me/cKure/8569 2022-01-17 12:28:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1350 2022-01-17 17:57:12+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1352...

CVE-2021-43297

CVE-2021-43297 describes a deserialization vulnerability in dubbo Hessian-Lite 3.2.11 and earlier that could enable remote code execution when Hessian mishandles deserialization. Affected are Apache Dubbo versions: 2.6.x before 2.6.12, 2.7.x before 2.7.15, and 3.0.x before 3.0.5. The root cause i...

CVE-2021-43297 Dubbo Hessian cause RCE when parse error

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some...