CVE-2021-36162: Unprotected yaml deserialization cause RCE
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36162?
The severity of CVE-2021-36162 is 8.8 (high).
What is Apache Dubbo?
Apache Dubbo is a framework for building high-performance RPC-based communication systems.
What is the vulnerability in Apache Dubbo (CVE-2021-36162)?
The vulnerability in Apache Dubbo (CVE-2021-36162) is related to configuration override or traffic routing rules.
What versions of Apache Dubbo are affected by CVE-2021-36162?
Apache Dubbo versions 2.7.0 to 2.7.12 and versions 3.0.0 to 3.0.1 are affected by CVE-2021-36162.
How can I fix the vulnerability in Apache Dubbo (CVE-2021-36162)?
To fix the vulnerability in Apache Dubbo (CVE-2021-36162), it is recommended to upgrade to a version that is not affected.