apache__incubator-dubbo_CVE-2021-30181_2-6-8

Apache Dubbo 项目 Apache Dubbo 是一个强大且易用的 Web 和 RPC 框架。它支持多种语言实现，例如 Java、Go、Python、PHP、Erlang、Rust 和 Node.js/Web。 Dubbo 为构建企业级微服务提供通信、服务发现、流量管理、可观测性、安全性、工具化及最佳实践等解决方案。 🚀 我们正在收集用户信息以改进 Dubbo。请在此处帮助我们：谁在使用 Dubbo 🧱 架构 消费者与提供者之间的通信通过 RPC 协议（如 Triple、TCP、REST 等）完成。 消费者从注册中心（例如...

CVE-2021-30181

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...

CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...