CVE-2021-25641: GHSL-2021-034_043: Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
Other sources
Multiple vulnerabilities have been found in Apache Dubbo enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25641?
CVE-2021-25641 is a vulnerability in Apache Dubbo servers where an attacker can choose the serialization id the Provider uses by tampering with flags.
What is the severity of CVE-2021-25641?
The severity of CVE-2021-25641 is critical, with a CVSS score of 9.8.
Which versions of Apache Dubbo are affected by CVE-2021-25641?
Apache Dubbo versions before 2.7.8 or 2.6.9 are affected by CVE-2021-25641.
How can an attacker exploit CVE-2021-25641?
An attacker can exploit CVE-2021-25641 by tampering with the byte preamble flags to choose the serialization id used by the Provider.
Is there a fix available for CVE-2021-25641?
Yes, upgrading to Apache Dubbo version 2.7.8 or 2.6.9 will fix CVE-2021-25641.