Vulnerability · Published Sep 7, 2021 · Assigned by apache
CVE-2021-36162Unprotected yaml deserialization cause RCE
High 8.8
In plain English
A high-severity security flaw in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | 2.7.13 | GHSA-r577-4hq7-73qh |
| Maven | org.apache.dubbo:dubbo | 3.0.2 | GHSA-r577-4hq7-73qh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – through 2.7.12Apache Dubbo 3.0.x – through 3.0.1 |