CVE-2019-17564 — Deserialization of Untrusted Data in Apache Dubbo

Description

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

Affected products

Vendor	Product	Affected	Fixed
Apache	Apache Dubbo	2.7.0 to 2.7.4, 2.6.0 to 2.6.7, all 2.5.x versions	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 7 repositories

Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget ★ 16 · Feb 20, 2020

Basic code for creating the Alibaba FastJson + Spring gadget chain, as used to exploit Apache Dubbo in CVE-2019-17564 - more information available at https://www.checkmarx.com/blog/apache-dubbo-unaut…
fairyming/CVE-2019-17564 ★ 8 · Feb 24, 2020

CVE-2019-17564：Apache Dubbo反序列化漏洞
Jaky5155/CVE-2019-17564 ★ 2 · Feb 13, 2020

CVE-2019-17564 Apache Dubbo deserialization RCE
Hu3sky/CVE-2019-17564 ★ 1 · Feb 14, 2020

CVE-2019-17564 : Apache Dubbo Deserialization Remote Code Execution
CyberCTF/vulhub-dubbo-cve-2019-17564 ★ 0 · Oct 8, 2026

Vulhub dubbo/CVE-2019-17564: Apache Dubbo HTTP Protocol Deserialization (CVE-2019-17564), run with Isoloom
Exploit-3389/CVE-2019-17564 ★ 0 · Feb 17, 2020
r00t4dm/CVE-2019-17564 ★ 0 · Feb 12, 2020

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization http/cves/2019/CVE-2019-17564.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.dubbo:dubbo-rpc-http-invoker	>= 2.5.0, < 2.7.5	2.7.5	GHSA-69wp-3pm3-hxgg

Deserialization of Untrusted Data in Apache Dubbo