Apache Software Foundation Dubbo

Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

Dubbo Zookeeper does not check serialization id

Dubbo Hessian cause RCE when parse error

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Bypass serialize checks in Apache Dubbo

Bypass deserialization checks in Apache Dubbo

Apache Dubbo default deserialization protocol Hessian2 cause CRE

Apache Dubbo Deserialization Vulnerability Gadgets Bypass

Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

Unsafe deserialization in providers using the Hessian protocol

Regular expression Denial of Service in MooTools

Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

Unprotected input value toString cause RCE

Apache Dubbo: Bypass deny serialize list check in Apache Dubbo

Unprotected yaml deserialization cause RCE

Open Redirect or SSRF vulnerability usage of parseURL

bypass of CVE-2021-25640