CVE-2021-30180: GHSL-2021-034_043: Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Other sources
Multiple vulnerabilities have been found in Apache Dubbo enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-30180?
CVE-2021-30180 is a vulnerability in Apache Dubbo prior to version 2.7.9 that allows customers to route requests to the right server using YAML rules, but may enable calling arbitrary constructs.
How severe is CVE-2021-30180?
CVE-2021-30180 has a severity rating of 9.8 out of 10, making it critical.
What is Apache Dubbo?
Apache Dubbo is a high-performance, lightweight, open-source Java RPC framework used for building microservices.
Which versions of Apache Dubbo are affected by CVE-2021-30180?
Apache Dubbo versions from 2.7.0 to 2.7.10 are affected by CVE-2021-30180.
How can the vulnerability be fixed?
To fix CVE-2021-30180, users should upgrade to Apache Dubbo version 2.7.9 or later.