cnvd - cnvd-2022-09241

cnvd-2022-09241

Vulnerability from cnvd

Title: Apache Dubbo代码问题漏洞

Description:

Apache Dubbo是美国阿帕奇（Apache）基金会的一款基于Java的轻量级RPC（远程过程调用）框架。该产品提供了基于接口的远程呼叫、容错和负载平衡以及自动服务注册和发现等功能。

Apache Dubbo存在代码问题漏洞，该漏洞源于 Dubbo Provider 会检查传入的请求以及该请求对应的序列化类型是否符合服务器设置的配置。攻击者可以利用该漏洞使用该例外情况跳过安全检查（启用时）并使用本机java序列化实现反序列化操作。

Severity: 高

Patch Name: Apache Dubbo代码问题漏洞的补丁

Patch Description:

Apache Dubbo存在代码问题漏洞，该漏洞源于 Dubbo Provider 会检查传入的请求以及该请求对应的序列化类型是否符合服务器设置的配置。攻击者可以利用该漏洞使用该例外情况跳过安全检查（启用时）并使用本机java序列化实现反序列化操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-37579

Impacted products

Name
['Apache Dubbo >=2.7.0，<2.7.13', 'Apache Dubbo >=3.0.0，<3.0.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-37579",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-37579"
    }
  },
  "description": "Apache Dubbo\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eJava\u7684\u8f7b\u91cf\u7ea7RPC\uff08\u8fdc\u7a0b\u8fc7\u7a0b\u8c03\u7528\uff09\u6846\u67b6\u3002\u8be5\u4ea7\u54c1\u63d0\u4f9b\u4e86\u57fa\u4e8e\u63a5\u53e3\u7684\u8fdc\u7a0b\u547c\u53eb\u3001\u5bb9\u9519\u548c\u8d1f\u8f7d\u5e73\u8861\u4ee5\u53ca\u81ea\u52a8\u670d\u52a1\u6ce8\u518c\u548c\u53d1\u73b0\u7b49\u529f\u80fd\u3002\n\nApache Dubbo\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e Dubbo Provider \u4f1a\u68c0\u67e5\u4f20\u5165\u7684\u8bf7\u6c42\u4ee5\u53ca\u8be5\u8bf7\u6c42\u5bf9\u5e94\u7684\u5e8f\u5217\u5316\u7c7b\u578b\u662f\u5426\u7b26\u5408\u670d\u52a1\u5668\u8bbe\u7f6e\u7684\u914d\u7f6e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u8be5\u4f8b\u5916\u60c5\u51b5\u8df3\u8fc7\u5b89\u5168\u68c0\u67e5\uff08\u542f\u7528\u65f6\uff09\u5e76\u4f7f\u7528\u672c\u673ajava\u5e8f\u5217\u5316\u5b9e\u73b0\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-09241",
  "openTime": "2022-02-09",
  "patchDescription": "Apache Dubbo\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u57fa\u4e8eJava\u7684\u8f7b\u91cf\u7ea7RPC\uff08\u8fdc\u7a0b\u8fc7\u7a0b\u8c03\u7528\uff09\u6846\u67b6\u3002\u8be5\u4ea7\u54c1\u63d0\u4f9b\u4e86\u57fa\u4e8e\u63a5\u53e3\u7684\u8fdc\u7a0b\u547c\u53eb\u3001\u5bb9\u9519\u548c\u8d1f\u8f7d\u5e73\u8861\u4ee5\u53ca\u81ea\u52a8\u670d\u52a1\u6ce8\u518c\u548c\u53d1\u73b0\u7b49\u529f\u80fd\u3002\r\n\r\nApache Dubbo\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e Dubbo Provider \u4f1a\u68c0\u67e5\u4f20\u5165\u7684\u8bf7\u6c42\u4ee5\u53ca\u8be5\u8bf7\u6c42\u5bf9\u5e94\u7684\u5e8f\u5217\u5316\u7c7b\u578b\u662f\u5426\u7b26\u5408\u670d\u52a1\u5668\u8bbe\u7f6e\u7684\u914d\u7f6e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u4f7f\u7528\u8be5\u4f8b\u5916\u60c5\u51b5\u8df3\u8fc7\u5b89\u5168\u68c0\u67e5\uff08\u542f\u7528\u65f6\uff09\u5e76\u4f7f\u7528\u672c\u673ajava\u5e8f\u5217\u5316\u5b9e\u73b0\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Dubbo\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Dubbo \u003e=2.7.0\uff0c\u003c2.7.13",
      "Apache Dubbo \u003e=3.0.0\uff0c\u003c3.0.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-37579",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-12",
  "title": "Apache Dubbo\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2021-37579 (GCVE-0-2021-37579)

Vulnerability from cvelistv5

Published

2021-09-09 07:45

Modified

2024-08-04 01:23

Severity ?

CWE

Remote Code Execution by tempering the serialization id on server side.

Summary

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Dubbo	Version: Apache Dubbo 2.7.x < Version: Apache Dubbo 3.0.x <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:23:01.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Dubbo",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.7.12",
              "status": "affected",
              "version": "Apache Dubbo 2.7.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.0.1",
              "status": "affected",
              "version": "Apache Dubbo 3.0.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there\u0027s an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution by tempering the serialization id on server side.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-09T07:45:12",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bypass deserialization checks in Apache Dubbo",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-37579",
          "STATE": "PUBLIC",
          "TITLE": "Bypass deserialization checks in Apache Dubbo"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Dubbo",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Dubbo 2.7.x",
                            "version_value": "2.7.12"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Dubbo 3.0.x",
                            "version_value": "3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there\u0027s an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {}
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution by tempering the serialization id on server side."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r898afa109cdbb4b79724308648ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-37579",
    "datePublished": "2021-09-09T07:45:12",
    "dateReserved": "2021-07-27T00:00:00",
    "dateUpdated": "2024-08-04T01:23:01.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted