PT-2021-19956 · Apache · Apache Dubbo
Alvaro Muñoz
+1
·
Published
2021-06-26
·
Updated
2023-01-10
·
CVE-2021-32824
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Dubbo versions prior to 2.6.10 and 2.7.10
Description
Apache Dubbo is a Java-based, open-source RPC framework. The issue concerns pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler, which offers basic methods to collect information about the providers and methods exposed by the service and can even allow shutting down the service. This endpoint is unprotected. A provider method can be invoked using the
invoke handler, which uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with PojoUtils.realize, which can be used to instantiate arbitrary classes and invoke their setters. Even though FastJson is properly protected with a default blocklist, PojoUtils.realize is not, allowing an attacker to leverage this for remote code execution.Recommendations
Versions prior to 2.6.10: Update to version 2.6.10 or later to resolve the issue.
Versions prior to 2.7.10: Update to version 2.7.10 or later to resolve the issue.
As a temporary workaround, consider restricting access to the Telnet Handler and the
invoke handler to minimize the risk of exploitation.Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Dubbo