Vulnerability · Published Sep 7, 2021 · Assigned by apache
CVE-2021-36163Unsafe deserialization in providers using the Hessian protocol
Critical 9.8
In plain English
A critical-severity security flaw in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | 2.7.13 | GHSA-cpx9-4rwv-486v |
| Maven | org.apache.dubbo:dubbo | 2.6.10.1 | GHSA-cpx9-4rwv-486v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – through 2.7.12Apache Dubbo 2.6.x – through 2.6.10 |