Description
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.6.x – < 2.6.12, Apache Dubbo 2.7.x – < 2.7.15, Apache Dubbo 3.0.x – < 3.0.5 | 2.6.12 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
longofo/Apache-Dubbo-Hessian2-CVE-2021-43297 ★ 46 · Jan 17, 2022
Apache Dubbo Hessian2 CVE-2021-43297 demo
-
bitterzzZZ/CVE-2021-43297-POC ★ 39 · Jan 17, 2022
CVE-2021-43297 POC，Apache Dubbo<= 2.7.13时可以实现RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | >= 2.6.0, < 2.6.12 | 2.6.12 | GHSA-vp5x-3v8r-qprw |
| Maven | org.apache.dubbo:dubbo | >= 2.7.0, < 2.7.15 | 2.7.15 | GHSA-vp5x-3v8r-qprw |
| Maven | org.apache.dubbo:dubbo | >= 3.0.0, < 3.0.5 | 3.0.5 | GHSA-vp5x-3v8r-qprw |