CVE-2021-25641

CRITICAL

Dubbo Zookeeper does not check serialization id

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-25641 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 curated repository PoC.

Description

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Curated repository PoCs
1

Affected products and versions

3
ProductSourceVersion range

Apache Dubbo

Browse Apache Software Foundation / Apache Dubbo
CVE ListApache Dubbo 2.7.x to < 2.7.8affected
Apache Dubbo 2.6.x to < 2.6.9affected

com.alibaba:dubbo

Browse Maven / com.alibaba:dubbo
GitHub Advisory2.5.0 to < 2.6.9 · Fixed in 2.6.9affected

org.apache.dubbo:dubbo

Browse Maven / org.apache.dubbo:dubbo
GitHub Advisory2.5.0 to < 2.7.8 · Fixed in 2.7.8affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-32824Curated repository PoCby exploitintel8Exploit23 files

C · 138.5 KiB · linked to 5 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A self-contained Python 3 exploit for CVE-2021-32824 that achieves pre-authentication remote code execution on Apache Dubbo <= 2.7.9. It generates malicious Java bytecode, starts LDAP and HTTP servers, and sends a crafted Telnet invoke command to trigger JNDI injection via the JdbcRowSetImpl gadget.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a standard CVE-2021-32824 exploit chain (JNDI injection via Dubbo Telnet) with no concealed backdoor or deceptive payload. All code serves the documented vulnerability demonstration.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespythonjava
Target softwareApache Dubbo
Attack typesremote code executionjndi injectiondeserialization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, poc/poc.py, is a complete, self-contained script that exercises the CVE-2021-32824 vulnerability to achieve remote code execution. It generates a payload, sets up attacker-controlled servers, delivers the payload to the target, and verifies the resulting code execution. This is the definition of an exploit.

poc/poc.py:1-787

Requirements

  • Network access to the target Dubbo service port (TCP 20880).poc/poc.py:22
  • Knowledge of at least one registered service method, discoverable via the unauthenticated 'ls' Telnet command.README.md:53
  • Target JVM must have com.sun.jndi.ldap.object.trustURLCodebase set to true (default on Java <= 8u191) or an alternative gadget chain must be used.README.md:291

Observed behavior

  • Generates a malicious Java class bytecode in pure Python that executes an arbitrary shell command in its static initializer.poc/poc.py:47-226
  • Starts an HTTP server to serve the generated malicious .class file.poc/poc.py:508-538
  • Starts an LDAP server that returns a JNDI Reference pointing to the HTTP server, triggering remote class loading.poc/poc.py:402-470
  • Connects to the target Dubbo Telnet interface and sends an 'invoke' command with a crafted JSON payload containing the JdbcRowSetImpl gadget class.poc/poc.py:545-597
  • Verifies successful exploitation by checking for LDAP and HTTP callbacks from the target.poc/poc.py:700-736
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe PoC sends a crafted invoke command to the Dubbo Telnet interface, triggering a JNDI lookup to an attacker-controlled LDAP server, which redirects to an HTTP server serving a malicious Java class that executes an arbitrary command. This is the documented CVE-2021-32824 exploit behavior.poc/poc.py:626-736
Binary Artifact
Payload withheldA compiled Java class flagged as binary and not analyzed. The corresponding source (poc/Exploit.java) shows it creates a proof-of-exploitation marker file, consistent with the PoC's stated purpose.poc/Exploit.java:1-30
Review boundaries

What the analysis did not establish

  • One binary file (poc/Exploit.class) was flagged and not analyzed; its metadata is reported but its content is uninspected.
  • The evidence packet reports complete_artifact_coverage as false due to the presence of the uninspected binary file.
  • One binary file (poc/Exploit.class) was not analyzed; its source is available and consistent with the PoC.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubDor-Tumarkin/CVE-2021-25641-Proof-of-ConceptRepository PoCby Dor-Tumarkin53Not analyzed5 files

18.4 KiB

GitHub
PoC details

References

2