Dubbo Hessian cause RCE when parse error
CVE-2021-43297

9.8CRITICAL

Key Information:

Vendor
Apache
Status
Apache Dubbo
Vendor
CVE Published:
10 January 2022

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

Affected Version(s)

Apache Dubbo Apache Dubbo 2.6.x < 2.6.12

Apache Dubbo Apache Dubbo 2.7.x < 2.7.15

Apache Dubbo Apache Dubbo 3.0.x < 3.0.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Apache-Dubbo-Hessian2-CVE-2021-43297
Created by longofo

CVE-2021-43297-POC
Created by bitterzzZZ

References

https://lists.apache.org/thread/1mszxrvp90y01xob56yp00293...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

There are differences in the use of entrances. The following people or organizations reported security vulnerabilities independently. Sort by discovery time: 1. cxc&yhbl&wh1t3p1g&fynch3r from G5-RD6@IIE 2. yxxx
.