GHSA-qvm7-23cj-437v

ghsaUSosv

Remote Code Execution in Apache Dubbo

view advisory published 2021-09-10Licence: CC-BY-4.0

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-36161US	critical9.8	2.47% (84th)	—	2021-09-09
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method.…

references

External citations — patches, advisories, analysis.

https://github.com/apache/dubboPACKAGE
https://lists.apache.org/thread.html/r40212261fd5d638074b65f22ac73eebe93ace310c79d4cfcca4863da%40%3Cdev.dubbo.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-36161ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan