Unsafe deserialization in providers using the Hessian protocol (Apache Software Foundation Apache Dubbo)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.25 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-cpx9-4rwv-486v — Hessian protocol configuration vulnerability in Apache Dubbo
European references
- ENISA EUVD · EUVD-2021-2042
- GCVE · GCVE-0-2021-36163
Affected configurations (NVD CPE)
cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*≥ 2.7.0 ≤ 2.7.12cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*≥ 3.0.0 ≤ 3.0.1
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Dubbo | affected Apache Dubbo 2.7.x ≤ 2.7.12 ; affected Apache Dubbo 2.6.x ≤ 2.6.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |