--- title: "CX-2020-4275" date: "2020-02-10T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4275/" --- # CX-2020-4275 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Dec 29, 2019 CVE-2019-17564 **Published:** Feb 10, 2020 9.8 Critical Severity Apache JAVA RCE unsafe deserialization DT Dor Tumarkin Reported by Checkmarx Zero Details Overview ## Summary Unsafe deserialization vulnerability in Apache Dubbo which has HTTP remoting enabled, could allow to trigger remote code execution with no authentication. This issue exists due to the use of a remote deserialization service in Spring Framework, whose documentation explicitly recommends not to use with untrusted data, combined with an outdated dependency. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo. ## Product Apache Dubbo 2.7.0 before 2.7.5, 2.6.0 before 2.6.8, and 2.5.x versions. ## Impact According to GitHub, more than 4,800 repositories are dependent on Dubbo. Among them are major Chinese Companies, including Alibaba Group and China Telecom. ## Steps to reproduce Once an attacker has the bean’s URL, all he has to do to exploit this vulnerability is to submit a malicious gadget chain via a standard POST request. Please see the [blog post](https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability/) for further information about this. ### Expected result Once the vulnerability is triggered by the malicious gadget chain sent by the attacker, the malicious code is executed, and an exception will be thrown. However, the application will continue to function as intended otherwise, resulting in stable exploitation for the given gadget chain. ## Remediation Update Dubbo dependency to 2.6.8 or 2.6.9, or to a version above 2.7.4. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [Dor Tumarkin](https://www.linkedin.com/in/dortumarkin/). ## Resources 1. [Blog](https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability/) 2. [Advisory](https://security-tracker.debian.org/tracker/CVE-2019-17564) 3. [Mail Thread](https://www.mail-archive.com/dev@dubbo.apache.org/msg06233.html) 4. [9b18fe2](https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b) 5. [POC Video](https://www.youtube.com/watch?v=1tjaly8rtqI&feature=youtu.be) 0 Critical Severity CVSS v3.1 Score 9.8 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Discovered Aug 13, 2019 Notified Apache 2. Fixed Dec 29, 2019 Apache Dubbo released fix in version 2.7.5 3. Published Feb 11, 2020 CVE-2019-17564 disclosed via [\[email protected\]](https://checkmarx.com/cdn-cgi/l/email-protection) mailing list ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)