GHSA-qvm7-23cj-437v CVE-2021-36161
Remote Code Execution in Apache Dubbo
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 2.47%
- Chance of exploitation in the next 30 days. Higher than 84.49% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-134 Use of Externally-Controlled Format String
- Fix
2.7.13- Upgrade org.apache.dubbo:dubbo to this version or later
Description
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.dubbo:dubbo | < 2.7.13 |
2.7.13 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.dubbo:dubbo Maven → 2.7.13
- maven
<dependency><groupId>org.apache.dubbo</groupId><artifactId>dubbo</artifactId><version>2.7.13</version></dependency>- gradle
implementation("org.apache.dubbo:dubbo:2.7.13")
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
How to prevent it
- Requirements: Choose a language that is not subject to this flaw.
- Implementation: Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
- Build and Compilation: Run compilers and linkers with high warning levels, since they may detect incorrect usage.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-97rv-88gf-phvr Apache Dubbo: Bypass deny serialize list check in Apache Dubbo | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-6x49-w35h-wqrj Bypass serialize checks in Apache Dubbo | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-933g-v89r-x8pf Apache Dubbo vulnerable to Deserialization of Untrusted Data | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-5qwq-g2hx-r6f7 Hessian Lite for Apache Dubbo deserialization vulnerability | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-gm48-83x4-84jg Server-side request forgery in Apache Dubbo | Medium | Also affects org.apache.dubbo:dubbo |
| GHSA-7wfc-x4f7-gg2x Code injection in Apache Dubbo | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-5mc7-m686-p6jg Deserialization of Untrusted Data in Apache Dubbo | Critical | Also affects org.apache.dubbo:dubbo |
| GHSA-qmfc-6www-fjqw Code injection in Apache Dubbo | Critical | Also affects org.apache.dubbo:dubbo |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor