Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
CVE-2021-30181

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Dubbo
Vendor
CVE Published:
1 June 2021

What is CVE-2021-30181?

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

Affected Version(s)

Apache Dubbo Apache Dubbo 2.7.x < 2.7.9

Apache Dubbo Apache Dubbo 2.6.x < 2.6.9

References

https://lists.apache.org/thread.html/re22410dc704a09bc703...
x_refsource_MISC

EPSS Score

61% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.