260 matches found
apache__dubbo_CVE-2021-30180_2-7-9
Apache Dubbo Project Apache Dubbo is a high-performance, Java-based open-source RPC framework. Please visit official site for quick start and documentations, as well as the wiki for news, FAQ, and release notes. We are now collecting Dubbo user info to help us to improve Dubbo further. Kindly...
dubbo-CVE-2023-23638
CVE-2023-23638 For educational purposes only ZooKeeper required Tested on Java 8. Other versions have not been tested and are not guaranteed to work. To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see...
Apache-Dubbo-CVE-2023-23638-exp
For a more comprehensive Dubbo vulnerability scanning tool, see my other project: https://github.com/YYHYlh/Dubbo-Scan Apache-Dubbo-CVE-2023-23638-exp An engineering practice for exploiting Apache Dubbo CVE-2023-23638, covering the entire process from service discovery to exploitation and echo in...
CVE-2019-17564
CVE-2019-17564: Apache Dubbo Deserialization Vulnerability 0x00 Introduction Apache Dubbo is a high-performance, lightweight open-source Java RPC framework. It provides three core capabilities: interface-based remote method invocation, intelligent fault tolerance and load balancing, and automatic...
cve-2020-1948-poc
cve-2020-1948-poc Apache Dubbo反序列化漏洞 install: pip3 install dubbo-py python3 cve-2020-1948.py Demo...
apache__incubator-dubbo_CVE-2021-30181_2-6-8
Apache Dubbo Project Apache Dubbo is a powerful and user-friendly Web and RPC framework. It supports multiple language implementations such as Java, Go, Python, PHP, Erlang, Rust, and Node.js/Web. Dubbo provides solutions for communication, service discovery, traffic management, observability,...
dubbo-rce
CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...
Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...
CVE-2021-25641-Proof-of-Concept
The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Alibaba Dubbo = 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions = 2.7.6 With Different Gadgets Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog...
CVE-2019-17564-FastJson-Gadget
CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7.3 Our full write-up is available at https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability Note that this is not an exploit ; it is a POC gadget chain used in an exploit used to demonstrate...
Dubbo-deserialization
Dubbo-deserialization CVE-2020-1948 La deserialización predeterminada de Apache Dubbo Provider provoca RCE Dubbo Study Dubbo-exp Dubbo-poc Dubbo复现环境...
Apache-Dubbo-Hessian2-CVE-2021-43297
Deserialización durante el manejo de excepciones Hessian2 en Apache Dubbo CVE-2021-43297 1. Importe los dos proyectos en dos instancias de IDEA 2. Primero ejecute org.apache.dubbo.samples.basic.BasicProvidermain para iniciar el servidor 3. Luego ejecute...
CVE-2021-43297-POC
CVE-2021-43297 Descripción de la vulnerabilidad Existe un riesgo potencial de ataque RCE en Dubbo Hessian-Lite 3.2.11 y versiones anteriores. Cuando Hessian-Lite encuentra una excepción de serialización, genera información relacionada, lo que puede provocar la invocación del método toString de...
CVE-2019-17564
CVE-2019-17564 CVE-2019-17564 Apache Dubbo 反序列化远程代码执行漏洞 video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4 video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4 video:https://video.twimg.com/tweetvideo/EQlT6nBUEAADdR2.mp4...
CVE-2019-17564
CVE-2019-17564 CVE-2019-17564 : Apache Dubbo 反序列化远程代码执行...
Dubbo-CVE-2020-1948
Apache Dubbo CVE-2020-1948 Test Environment Introduction When this vulnerability first emerged, in order to verify its impact, we searched the internet for many examples compiled by others, but found none that could successfully validate it. So we created one ourselves and put it here for your...
Dubbo-deserialization
Apache Dubbo Deserialization Vulnerability Research This repository contains research materials, proof-of-concept code, and exploitation tools related to Apache Dubbo deserialization vulnerabilities, primarily focusing on CVE-2020-1948. Repository Structure Directories...
CVE-2022-40087
creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71968 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:36+00:00| seen|...
Remote Code Execution (RCE)
org.apache.dubbo:dubbo is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization handling in hessian-lite during exception logging, which allows an attacker to execute malicious code through crafted serialized data...
