PT-2021-16720 · Apache · Apache Dubbo

Jun Liu · Published 2021-05-29 · Updated 2022-03-18 · CVE-2021-25641

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.8 Apache Dubbo versions prior to 2.6.9

Description The issue allows an attacker to choose the serialization id used by the Provider, bypassing the server's instruction. This can lead to exploitation if a weak deserializer, such as Kryo or FST, is in the code scope. A remote unauthenticated attacker can exploit this weakness.

Recommendations For Apache Dubbo versions prior to 2.7.8, update to version 2.7.8 or later. For Apache Dubbo versions prior to 2.6.9, update to version 2.6.9 or later. As a temporary workaround, consider disabling the use of weak deserializers, such as Kryo and FST, until a patch is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-25641

GHSA-V2RG-8CWR-75G8

Affected Products

Apache Dubbo

References · 8

• 🔥 https://github.com/Dor-Tumarkin/CVE-2021-25641-Proof-of-Concept · Exploit
• 🔥 https://github.com/l0n3rs/CVE-2021-25641 · Exploit
• https://osv.dev/vulnerability/GHSA-v2rg-8cwr-75g8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25641 · Vendor Advisory
• https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25641 · Security Note
• https://t.me/cvenotify/16090 · Telegram Post
• https://t.me/cybersecuritytechnologies/3699 · Telegram Post