CVE-2021-30181GHSA-QMFC-6WWW-FJQW
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.9, 2.6.9, 2.7.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Timeline
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache Dubbo
From Apache Dubbo 2.7.x · fixed in 2.7.9; From Apache Dubbo 2.6.x · fixed in 2.6.9
- com.alibaba:dubboMaven
From 2.5.0 · fixed in 2.6.9
- org.apache.dubbo:dubboMaven
From 2.5.0 · fixed in 2.7.10