PT-2022-11816 · Apache · Apache Dubbo+1

Cxc + 4 · Published 2022-01-10 · Updated 2022-01-18 · CVE-2021-43297

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.6.12 Apache Dubbo versions prior to 2.7.15 Apache Dubbo versions prior to 3.0.5 dubbo hessian-lite versions 3.2.11 and earlier

Description A deserialization vulnerability existed in dubbo hessian-lite, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol. During Hessian, catching unexpected exceptions will log out some information for users, which may cause remote command execution.

Recommendations For Apache Dubbo versions prior to 2.6.12, update to version 2.6.12 or later. For Apache Dubbo versions prior to 2.7.15, update to version 2.7.15 or later. For Apache Dubbo versions prior to 3.0.5, update to version 3.0.5 or later. For dubbo hessian-lite versions 3.2.11 and earlier, update to a version later than 3.2.11. As a temporary workaround, consider disabling the Hessian2 protocol until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-43297

GHSA-VP5X-3V8R-QPRW

Affected Products

Apache Dubbo

Dubbo Hessian-Lite

References · 10

• 🔥 https://github.com/longofo/Apache-Dubbo-Hessian2-CVE-2021-43297 · Exploit
• 🔥 https://github.com/bitterzzZZ/CVE-2021-43297-POC · Exploit
• https://osv.dev/vulnerability/GHSA-vp5x-3v8r-qprw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43297 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43297 · Vendor Advisory
• https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww · Vendor Advisory
• https://t.me/cvenotify/25623 · Telegram Post
• https://t.me/ckure/10532 · Telegram Post
• https://t.me/pentestingnews/17071 · Telegram Post
• https://t.me/cvenotify/25162 · Telegram Post