GitHub Advisoryadvisory · Maven

GHSA-qmfc-6www-fjqw Code injection in Apache Dubbo

CRITICAL Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2021-30181
Ecosystem
Maven
Packages
com.alibaba:dubbo, org.apache.dubbo:dubbo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-06-02

Affected packages

• Maven com.alibaba:dubbo: >= 2.5.0, < 2.6.9 → fixed in 2.6.9 • Maven org.apache.dubbo:dubbo: >= 2.5.0, < 2.7.10 → fixed in 2.7.10

Description

Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

Related

Alias · CVE (1)

  • CVE-2021-30181 Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References