Vulnerability · Published May 31, 2021 · Assigned by apache
CVE-2021-30180Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Critical 9.8
In plain English
A critical-severity security flaw in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 60.3% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | 2.7.10 | GHSA-7wfc-x4f7-gg2x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – before 2.7.9 |