PT-2021-18653 · Apache · Apache Dubbo

Published 2021-05-31 · Updated 2022-03-18 · CVE-2021-30179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.6.9 and 2.7.9

Description The issue allows for generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter, which uses the Java Reflection API to make the final call. The invoke or invokeAsync methods have a signature that includes the method name, parameter types, and actual call arguments. An attacker can control the RPC attachment, setting it to nativejava to force Java deserialization of a byte array, potentially leading to exploitation.

Recommendations For Apache Dubbo versions prior to 2.6.9, update to version 2.6.9 or later. For Apache Dubbo versions prior to 2.7.9, update to version 2.7.9 or later. As a temporary workaround, consider restricting the RPC attachment values to prevent setting it to nativejava until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-30179

GHSA-5MC7-M686-P6JG

Affected Products

Apache Dubbo

References · 6

• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mc7-m686-p6jg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30179 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30179 · Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67@%3Cdev.dubbo.apache.org%3E · Note
• https://t.me/cybersecuritytechnologies/3699 · Telegram Post