229 matches found
CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...
CVE-2021-30179 Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...
CVE-2021-30179
Apache Dubbo CVE-2021-30179 affects versions prior to 2.6.9 and 2.7.9. The vulnerability arises because GenericFilter allows generic calls to arbitrary methods on provider interfaces, using Java Reflection. The invocation of $invoke/$invokeAsync uses a first argument method name, parameter types,...
CVE-2021-25640 Open Redirect or SSRF vulnerability usage of parseURL
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability...
CVE-2021-25640
CVE-2021-25640 affects Apache Dubbo prior to versions 2.6.12 and 2.7.15, where the parseURL method can bypass white-host checks, enabling open redirect or SSRF. Impacted components and exact root cause are described across multiple sources; exploitation status is not detailed here. Remediation is...
PT-2021-16719 · Apache · Apache Dubbo
Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions prior to 2.6.9 and 2.7.9 Apache Dubbo versions prior to 2.6.9 and 2.7.10 Apache Dubbo versions prior to 2.6.12 and 2.7.15 However, to consolidate the ranges of affected versions into the most concise form and avoid...
CVE-2021-25641
CVE-2021-25641 affects Apache Dubbo servers prior to 2.7.8 and 2.6.9. The vulnerability arises when a provider’s byte preamble flags are tampered with, allowing an attacker to override the server’s chosen serialization protocol and trigger a weak deserializer (e.g., Kryo or FST) in scope. This en...
CVE-2021-25641 Dubbo Zookeeper does not check serialization id
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following t...
CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...
The vulnerability of the Apache Dubbo RPC framework lies in errors during the validation of input data according to the Dubbo protocol, allowing attackers to execute arbitrary code.
The vulnerability of the Apache Dubbo RPC framework is related to errors in checking input data according to the Dubbo protocol. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
(0Day) Apache Dubbo decodeBody Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Dubbo. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Dubbo protocol. Crafted data in a Dubbo protocol message can trigger th...
(0Day) Apache Dubbo readUTF Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Dubbo. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Dubbo protocol. Crafted data in a Dubbo protocol message can trigger th...
CVE-2020-11995
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
CVE-2020-11995
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
Deserialization of untrusted data
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
CVE-2020-11995 Apache Dubbo default deserialization protocol Hessian2 cause CRE
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
CVE-2020-11995
This CVE describes a deserialization vulnerability in Apache Dubbo up to version 2.7.5 (and earlier) where Hessian2 deserializing a HashMap can trigger code execution via certain class methods (notably EqualsBean in rome-1.7.0.jar). The issue arises from the default Hessian2 deserialization path ...
Apache Dubbo Code Issue Vulnerability
Apache Dubbo is the United States Apache Software Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. It provides interface-based remote calling, fault tolerance and load balancing, and automated service registration and discovery. A code issue vulnerability exists ...
Apache Dubbo Remote Code Execution (CVE-2020-1948)
A remote code execution vulnerability exists in Apache Dubbo. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
