Remote Code Execution (RCE)

dubbo is vulnerable to remote code execution. when using default rules with ScriptEngine, An attacker can inject and execute malicious scripts via Script route poisoning...

CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...