CVE-2021-36163

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without...

Design/Logic Flaw

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without...

CVE-2021-36163 Unsafe deserialization in providers using the Hessian protocol

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without...

CVE-2021-36163

Summary: CVE-2021-36163 affects Apache Dubbo when using the Hessian protocol. The HessianSkeleton can be created without configuring the serialization factory, bypassing the dubbo type-list checks. As a result, the generic service is exposed, so an attacker may not need a valid service/method nam...

CVE-2021-36162 Unprotected yaml deserialization cause RCE

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

CVE-2021-36162

Apache Dubbo (routing/configuration rules loaded from config centers like Zookeeper or Nacos) is affected by CVE-2021-36162 through unsafe YAML deserialization using SnakeYAML, which can enable arbitrary constructor invocation and remote code execution when consumers retrieve tampered rules. The ...

Apache Dubbo 代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. It provides interface-based remote calling, fault tolerance and load balancing, and automated service registration and discovery. A security vulnerability exists in Apache...

Apache dubbo suffers from a deserialization vulnerability (CNVD-2021-49587)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. Apache dubbo has a deserialization vulnerability that can be exploited by attackers to achieve command execution, server-side request forgery and other attacks...

Apache Dubbo suffers from a deserialization vulnerability

Apache Dubbo is Apache's a lightweight Java-based RPC Remote Procedure Call framework. Apache Dubbo has a deserialization vulnerability that can be exploited by an attacker to gain control of the server...

PT-2021-19956 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions prior to 2.6.10 and 2.7.10 Description: Apache Dubbo is a Java-based, open-source RPC framework. The issue concerns pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Al...

Unspecified Vulnerability in Apache Dubbo (CNVD-2021-41082)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...

Unspecified Vulnerability in Apache Dubbo

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability previousl...

Apache Dubbo Deserialization Vulnerability (CNVD-2021-41088)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...

Remote Code Execution

apache dubbo is vulnerable to remote code execution. Unsafe deserialization allows an attacker to execute arbitrary code through arbitrary constructors by submitting malicious YAML rules...

CVE-2021-25640

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability...

CVE-2021-30180

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

CVE-2021-30181

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...

CVE-2021-30179

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...

CVE-2021-25641

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following t...