Vulnerability · Published May 29, 2021 · Assigned by apache
CVE-2021-30181Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Critical 9.8
In plain English
A critical-severity security flaw in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 60.9% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.alibaba:dubbo | 2.6.9 | GHSA-qmfc-6www-fjqw |
| Maven | org.apache.dubbo:dubbo | 2.7.10 | GHSA-qmfc-6www-fjqw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – before 2.7.9Apache Dubbo 2.6.x – before 2.6.9 |