PT-2020-15186 · Apache · Dubbo

Published 2020-07-14 · Updated 2022-02-10 · CVE-2020-1948

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dubbo versions 2.7.6 and earlier

Description This issue affects Dubbo users, allowing an attacker to send RPC requests with unrecognized service names or method names, along with malicious parameter payloads. When the malicious parameter is deserialized, it executes malicious code.

Recommendations For Dubbo versions 2.7.6 and earlier, update to a version higher than 2.7.6 to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-1948

GHSA-WHWW-V56C-CGV2

Affected Products

Dubbo

References · 9

• 🔥 https://github.com/ctlyz123/CVE-2020-1948 · Exploit
• 🔥 https://github.com/L0kiii/Dubbo-deserialization · Exploit
• 🔥 https://github.com/M3g4Byt3/cve-2020-1948-poc · Exploit
• 🔥 https://github.com/txrw/Dubbo-CVE-2020-1948 · Exploit
• https://osv.dev/vulnerability/GHSA-whww-v56c-cgv2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1948 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1948 · Vendor Advisory
• https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert · Note
• https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E · Note