CVE-2021-36163GHSA-CPX9-4RWV-486V
Unsafe deserialization in providers using the Hessian protocol
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.13, 2.6.10.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Dubbo
From Apache Dubbo 2.7.x · through 2.7.12; From Apache Dubbo 2.6.x · through 2.6.10
- org.apache.dubbo:dubboMaven
From 2.7.0 · fixed in 2.7.13
- org.apache.dubbo:dubboMaven
fixed in 2.6.10.1