289 matches found
apache__incubator-dubbo_CVE-2021-30181_2-6-8
Apache Dubbo Project Apache Dubbo is a powerful and user-friendly Web and RPC framework. It supports multiple language implementations such as Java, Go, Python, PHP, Erlang, Rust, and Node.js/Web. Dubbo provides solutions for communication, service discovery, traffic management, observability,...
Dubbo-CVE-2020-1948
Apache Dubbo CVE-2020-1948 Test Environment Introduction When this vulnerability first emerged, in order to verify its impact, we searched the internet for many examples compiled by others, but found none that could successfully validate it. So we created one ourselves and put it here for your...
dubbo-rce
CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...
Apache-Dubbo-CVE-2023-23638-exp
For a more comprehensive Dubbo vulnerability scanning tool, see my other project: https://github.com/YYHYlh/Dubbo-Scan Apache-Dubbo-CVE-2023-23638-exp An engineering practice for exploiting Apache Dubbo CVE-2023-23638, covering the entire process from service discovery to exploitation and echo in...
CVE-2019-17564
CVE-2019-17564: Apache Dubbo Deserialization Vulnerability 0x00 Introduction Apache Dubbo is a high-performance, lightweight open-source Java RPC framework. It provides three core capabilities: interface-based remote method invocation, intelligent fault tolerance and load balancing, and automatic...
apache__dubbo_CVE-2021-30180_2-7-9
Apache Dubbo Project...
CVE-2021-25641
CVE-2021-25641 A Exploit Tool For CVE-2021-25641. All dependencies was packed,You don't care the dependencies problem If you have dependencies you can just donwload the CVE-2021-25641.jar to run. Used for: Basic dubbo-common =2.7.3 Dubbo 2.7.0 to 2.7.8 Dubbo 2.6.0 to 2.6.9 Dubbo all 2.5.x version...
dubbo-CVE-2023-23638
CVE-2023-23638 仅供学习研究 ZooKeeper 自备 测试环境为 Java 8, 其它版本尚未测试, 不保证可用性 复现时需要为 DemoComsumer 添加 VM 参数: -Ddubbo.hessian.allowNonSerializable=true, 详情参考 https://su18.org/post/hessian/serializable 分析文章: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ POC 的本质是利用某个 class 修改...
Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...
cve-2020-1948-poc
cve-2020-1948-poc Apache Dubbo Deserialization Vulnerability install: root@kitploit: pip3 install dubbo-py root@kitploit: python3 cve-2020-1948.py Demo...
Dubbo-deserialization
Apache Dubbo Deserialization Vulnerability Research This repository contains research materials, proof-of-concept code, and exploitation tools related to Apache Dubbo deserialization vulnerabilities, primarily focusing on CVE-2020-1948. Repository Structure Directories...
CVE-2021-25641-Proof-of-Concept
The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Alibaba Dubbo = 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions = 2.7.6 With Different Gadgets Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog...
CVE-2019-17564-FastJson-Gadget
CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7.3 Our full write-up is available at https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability Note that this is not an exploit ; it is a POC gadget chain used in an exploit used to demonstrate...
Apache-Dubbo-Hessian2-CVE-2021-43297
Deserialization during Apache Dubbo Hessian2 Exception Handling CVE-2021-43297 1. Import the two projects into two separate IDEA instances 2. First run org.apache.dubbo.samples.basic.BasicProvidermain to start the server 3. Then run org.apache.dubbo.samples.basic.BasicConsumermain to start the...
CVE-2021-43297-POC
CVE-2021-43297 漏洞描述 Dubbo Hessian-Lite 3.2.11及之前版本中存在潜在RCE攻击风险。Hessian-Lite在遇到序列化异常时会输出相关信息，这可能导致触发某些恶意定制的Bean的toString方法，从而引发RCE攻击。 原理 最开始的POC只能在Apache Dubbo=2.7.8实现RCE，原理见先知文章审核通过后回来修改。投稿之后又研究了一下，可以在Apache Dubbo=2.7.13实现RCE，原理分析见我的博客文章 效果如下 POC利用条件： apache dubbo = 2.7.13或alibaba dubbo对应版本 知道dub...
CVE-2019-17564
CVE-2019-17564 CVE-2019-17564 Apache Dubbo deserialization RCE video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4 video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4 video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4...
CVE-2019-17564
CVE-2019-17564 CVE-2019-17564 : Apache Dubbo Deserialization Remote Code Execution...
CVE-2022-40087
creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71968 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:36+00:00| seen|...
