CVE-2021-30181: GHSL-2021-034_043: Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Other sources
Multiple vulnerabilities have been found in Apache Dubbo enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-30181?
The severity of CVE-2021-30181 is critical with a CVSS score of 9.8.
What is Apache Dubbo?
Apache Dubbo is a high-performance, Java-based open-source RPC (remote procedure call) framework.
What is Script routing in Apache Dubbo?
Script routing is a feature in Apache Dubbo that allows customers to route requests to the right server based on rules specified in scripts.
How does Apache Dubbo use ScriptEngine?
Apache Dubbo customers use ScriptEngine to parse and execute the rules for Script routing.
What is the fix for CVE-2021-30181?
To fix CVE-2021-30181, update Apache Dubbo to version 2.6.10 or 2.7.10 or later.