by Kastro
Paper/Archive/CVE-2021-43297

CVE-2021-43297

Apache Software Foundation Apache Dubbo — Dubbo Hessian cause RCE when parse error

EPSS 17%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.0.970 × 2019.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

Affected

ProductAffectedFixed inSource
Apache DubboApache Dubbo 2.6.x – < 2.6.122.6.12CNA
Apache DubboApache Dubbo 2.7.x – < 2.7.152.7.15CNA
Apache DubboApache Dubbo 3.0.x – < 3.0.53.0.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww