CVE-2019-17564
CRITICAL EXPLOITED IN THE WILD NUCLEIApache Dubbo 2.5.0-2.5.9, 2.6.0-2.6.7, 2.7.0-2.7.4 - Remote Code Execution via Unsafe Java Deserialization
Title source: llmExploitation Summary
CVE-2019-17564 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 6 public exploits from researchers including Dor-Tumarkin, fairyming, Jaky5155. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2019-17564, demonstrating a deserialization gadget chain in FastJson and Spring Framework to achieve RCE in Apache Dubbo 2.7.3. The gadget chain leverages TemplatesImpl and XString to trigger arbitrary command execution via Runtime.exec().
Description
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Exploits (6)
This repository contains a functional PoC for CVE-2019-17564, demonstrating a deserialization gadget chain in FastJson and Spring Framework to achieve RCE in Apache Dubbo 2.7.3. The gadget chain leverages TemplatesImpl and XString to trigger arbitrary command execution via Runtime.exec().
This repository provides a detailed technical analysis of CVE-2019-17564, an Apache Dubbo deserialization vulnerability. It includes environment setup instructions, exploitation steps using ysoserial, and mitigation strategies.
The repository contains no exploit code or technical details, only repeated links to a video. This is characteristic of a social engineering lure rather than a legitimate PoC.
The repository contains only a README with minimal information about CVE-2019-17564, lacking any exploit code or technical details. It is a placeholder with no functional content.
The repository contains only a minimal README with no functional exploit code or technical details. It appears to be a placeholder or incomplete submission.
The repository contains only a README with a title and an image reference, lacking any exploit code or technical details. It appears to be a placeholder or incomplete submission.
Nuclei Templates (1)
app="apache-dubbo"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H