advisory.checkmarx.net
https://advisory.checkmarx.net/advisory/CX-2020-4275 CVE-2019-17564
CRITICALNuclei
Deserialization of Untrusted Data in Apache Dubbo
Record summary
CVE-2019-17564 has a selected CVSS score of 9.8 (critical); EIP currently links 6 repository PoCs and 1 Nuclei template.
Description
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Description source: CVE List
Exploitation context
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Apache DubboBrowse Apache / Apache Dubbo | CVE List | 2.7.0 to 2.7.4 | affected |
| 2.6.0 to 2.6.7 | affected | ||
| all 2.5.x versions | affected | ||
| VulnCheck | Version data not supplied | ||
org.apache.dubbo:dubbo-rpc-http-invokerBrowse Maven / org.apache.dubbo:dubbo-rpc-http-invoker | GitHub Advisory | 2.5.0 to < 2.7.5 · Fixed in 2.7.5 | affected |
Proofs of concept
6Repository PoCs
GitHubr00t4dm/CVE-2019-17564Repository PoCby r00t4dmStars: 0Not analyzed3 files
GitHubJaky5155/CVE-2019-17564Repository PoCby Jaky5155Stars: 2Not analyzed1 file
GitHubHu3sky/CVE-2019-17564Repository PoCby Hu3skyStars: 1Not analyzed2 files
GitHubExploit-3389/CVE-2019-17564Repository PoCby Exploit-3389Stars: 0Not analyzed1 file
GitHubDor-Tumarkin/CVE-2019-17564-FastJson-GadgetRepository PoCby Dor-TumarkinStars: 16Not analyzed4 files
GitHubfairyming/CVE-2019-17564Repository PoCby fairymingStars: 8Not analyzed6 files
Nuclei templates
1ProjectDiscoveryCRITICALApache Dubbo 2.5.x-2.7.4 - Insecure DeserializationCVSS 9.8
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Impact
Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code on Dubbo Provider instances with HTTP remoting enabled, leading to complete server compromise.
Remediation
Upgrade to Apache Dubbo version 2.7.5 or later, or disable HTTP remoting if not required.
WeaknessesCWE-502
AuthorsKhalid6468
Template tagscvecve2019dubboapachedeserializationrcevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*
FOFA: app="apache-dubbo"
https://advisory.checkmarx.net/advisory/CX-2020-4275 https://github.com/Hu3sky/CVE-2019-17564 https://github.com/r00t4dm/CVE-2019-17564 https://dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/
Source: ProjectDiscovery
References
5github.com
https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b github.com
https://github.com/apache/dubbo/releases/tag/dubbo-2.7.5 lists.apache.org
https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-17564