Design/Logic Flaw

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

CVE-2020-1948

CVE-2020-1948 affects Apache Dubbo before 2.7.8 (and related versions) where deserialization of untrusted data in RPC requests can trigger remote code execution. The vulnerability targets the Dubbo Provider component and allows an attacker to send RPC calls with unrecognized service/method names ...

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

Apache Dubbo Deserialization Vulnerability Research This repo...

PT-2020-15186

Name of the Vulnerable Software and Affected Versions Dubbo versions 2.7.6 and earlier Description This issue affects Dubbo users, allowing an attacker to send RPC requests with unrecognized service names or method names, along with malicious parameter payloads. When the malicious parameter is...

CVE-2020-1948: Deserialization of Untrusted Data

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

cve-2020-1948-poc Apache Dubbo反序列化漏洞...

Remote Code Execution (RCE)

dubbo-rpc-dubbo is vulnerable to remote code execution RCE. The library does not ignore deserialization when service or method not found, allowing a malicious user to execute malicious code by sending the rpc requests with unrecognized service name or method name...

Apache Dubbo Provider Remote Code Execution Vulnerability

Apache Dubbo is a Java-based high-performance RPC framework . A remote code execution vulnerability exists in Apache Dubbo Provider. An attacker can send RPC requests with unauthenticated service names or method names in conjunction with additional malicious parameter loads. When the malicious...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

Deserialization of untrusted data

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

CVE-2019-17564

A critical unsafe deserialization vulnerability exists in the Apache Dubbo RPC framework when HTTP remoting is enabled. The root cause is the improper handling of message bodies, which allows an unauthenticated attacker to submit a POST request containing a malicious Java object. If usable gadget...

CVE-2019-17564: Deserialization of Untrusted Data

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

Apache Dubbo Insecure Deserialization (CVE-2019-17564)

An insecure deserialization vulnerability exists in Apache Dubbo. The vulnerability is due to deserialization of untrusted data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7...

Unauthorized Access Vulnerability in Apache Dubbo

Apache Dubbo is Alibaba's open source service framework that allows applications to achieve high-performance RPC service output and input functions can be integrated with the Spring Framework . Apache Dubbo has an unauthorized access vulnerability that can be exploited by attackers to obtain...