CVE-2019-17564 Deserialization of Untrusted Data in Apache Dubbo

What is CVE-2019-17564?

CVE-2019-17564 is a critical unsafe deserialization vulnerability in Apache Dubbo, published on 1 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

Weakness: CWE-502

Which versions are affected by CVE-2019-17564?

2 open source packages ship an affected version, including org.apache.dubbo:dubbo-rpc-http-invoker. It affects 1 product.

Products include Apache Dubbo.

How do I fix CVE-2019-17564?

Upgrade org.apache.dubbo:dubbo-rpc-http-invoker to 2.7.5 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-17564 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-17564 exists.

Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.

Other vulnerabilities in Apache Dubbo

• CVE-2023-29234 Bypass serialize checks in Apache Dubbo Critical 9.8
• CVE-2023-46279 Apache Dubbo: Bypass deny serialize list check in Apache Dubbo Critical 9.8
• CVE-2021-32824 Regular expression Denial of Service in MooTools Critical 9.8
• CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass Critical 9.8
• CVE-2021-43297 Dubbo Hessian cause RCE when parse error Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-69wp-3pm3-hxgg.