CVE-2021-36163
published 2021-09-07CVE-2021-36163: In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.90%
85.3th percentile
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | dubbo | 2.7.0 – 2.7.12 | — |
| apache | dubbo | 3.0.0 – 3.0.1 | — |
| apache_software_foundation | apache_dubbo | Apache Dubbo 2.6.x – 2.6.10 | — |
| apache_software_foundation | apache_dubbo | Apache Dubbo 2.7.x – 2.7.12 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Hessian protocol configuration vulnerability in Apache Dubbo
osv·2021-09-08
CVE-2021-36163 [CRITICAL] Hessian protocol configuration vulnerability in Apache Dubbo
Hessian protocol configuration vulnerability in Apache Dubbo
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
GHSA
Hessian protocol configuration vulnerability in Apache Dubbo
ghsa·2021-09-08
CVE-2021-36163 [CRITICAL] CWE-502 Hessian protocol configuration vulnerability in Apache Dubbo
Hessian protocol configuration vulnerability in Apache Dubbo
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-07
Published