Summary
Unsafe deserialization vulnerability in Apache Dubbo which has HTTP remoting enabled, could allow to trigger remote code execution with no authentication.
This issue exists due to the use of a remote deserialization service in Spring Framework, whose documentation explicitly recommends not to use with untrusted data, combined with an outdated dependency. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo.
Product
Apache Dubbo 2.7.0 before 2.7.5, 2.6.0 before 2.6.8, and 2.5.x versions.
Impact
According to GitHub, more than 4,800 repositories are dependent on Dubbo. Among them are major Chinese Companies, including Alibaba Group and China Telecom.
Steps to reproduce
Once an attacker has the bean’s URL, all he has to do to exploit this vulnerability is to submit a malicious gadget chain via a standard POST request.
Please see the blog post for further information about this.
Expected result
Once the vulnerability is triggered by the malicious gadget chain sent by the attacker, the malicious code is executed, and an exception will be thrown. However, the application will continue to function as intended otherwise, resulting in stable exploitation for the given gadget chain.
Remediation
Update Dubbo dependency to 2.6.8 or 2.6.9, or to a version above 2.7.4.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher Dor Tumarkin.
