CVE-2020-1948

CRITICAL

Deserialization of Untrusted Data in Apache Dubbo

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-1948 has a selected CVSS score of 9.8 (critical); EIP currently links 3 repository PoCs and 1 lab environment.

Description

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3
Lab environments
1

Affected products and versions

3
ProductSourceVersion range

Apache Dubbo

CVE ListApache Dubbo 2.5.x, 2.6.0 to 2.6.8, 2.7.0 to 2.7.7affected

org.apache.dubbo:dubbo

Browse Maven / org.apache.dubbo:dubbo
GitHub AdvisoryBefore 2.7.7 · Fixed in 2.7.7affected

org.apache.dubbo:dubbo-common

Browse Maven / org.apache.dubbo:dubbo-common
GitHub AdvisoryBefore 2.7.7 · Fixed in 2.7.7affected

Proofs of concept

3

Repository PoCs

GitHubctlyz123/CVE-2020-1948Repository PoCby ctlyz12315Not analyzed134 files

819.4 KiB

GitHub
PoC details
GitHubtxrw/Dubbo-CVE-2020-1948Repository PoCby txrw4Not analyzed14 files

43.0 KiB

GitHub
PoC details
GitHubM3g4Byt3/cve-2020-1948-pocRepository PoCby M3g4Byt33Not analyzed3 files

183.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

txrw/Dubbo-CVE-2020-1948Created Vuln labCVE-2020-1948Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a Dubbo Spring Boot provider sample, exposed on port 12345, intended for testing CVE-2020-1948.

docker-compose.yml:1-9Dockerfile:1-19README.md:1-73

Lab assessment

Vulnerability lab

The README explicitly states the environment is for testing CVE-2020-1948, and the Docker image is tagged accordingly.

README.md:1docker-compose.yml:5
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

api

Dubbo providervulnerability target

A Java service built from the provided source, running a Dubbo Spring Boot provider that listens on port 12345 and implements the DemoService interface.

docker-compose.yml:4-8Dockerfile:1-19src/dubbo-spring-boot-samples/auto-configure-samples/provider-sample/src/main/resources/application.properties:8-9src/dubbo-spring-boot-samples/auto-configure-samples/provider-sample/src/main/java/org/apache/dubbo/spring/boot/sample/provider/service/DefaultDemoService.java:30-62
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-1948

Insufficient evidence

The environment is labeled for CVE-2020-1948, but no exploit code, vulnerable library version, or specific deserialization trigger is visible in the supplied evidence. The README links to an external wiki for verification steps, which are not included.

README.md:1README.md:57-59
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and docker-compose must be installed to build and run the environment.README.md:49-51
  • The Dubbo provider must be running and listening on port 12345.README.md:27-29

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile or use the pre-built image.README.md:37-39
  2. Start the container with docker-compose, exposing port 12345.README.md:41-43
  3. Connect to the service via telnet on port 12345 to confirm it is running.README.md:29-33
  4. Follow the external wiki instructions to verify the CVE-2020-1948 vulnerability.README.md:57-59
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment only exposes a Dubbo service on a mapped port. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The README describes a standard vulnerability lab setup.

docker-compose.yml:1-9Dockerfile:1-19README.md:1-73
Review boundaries

What the analysis did not establish

  • No exploit payload or deserialization gadget is included; the actual vulnerability verification steps are external and not supplied.
  • The Dockerfile uses a non-official base image (szgx/java:8u111_debian) whose contents are uninspected.
  • The README references an external wiki for vulnerability verification, which is not part of the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3