CVE-2021-36162 Unprotected yaml deserialization cause RCE
An attacker with configuration center access can poison YAML rules to achieve remote code execution on Dubbo consumers via unsafe SnakeYAML deserialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36162?
CVE-2021-36162 is a high-severity unsafe deserialization vulnerability in Apache Dubbo, published on 7 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Which versions are affected by CVE-2021-36162?
4 open source packages ship an affected version, including org.apache.dubbo:dubbo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.dubbo:dubbo Maven | All versions | 2.7.13 |
org.apache.dubbo:dubbo Maven | All versions | 2.7.13 |
org.apache.dubbo:dubbo Maven | From 3.0.0 | 3.0.2 |
org.apache.dubbo:dubbo Maven | From 3.0.0 | 3.0.2 |
Products include Apache Dubbo.
How do I fix CVE-2021-36162?
Upgrade org.apache.dubbo:dubbo to a fixed version for your release line: 2.7.13 or 3.0.2.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-36162 being exploited?
There is no known exploitation of CVE-2021-36162 in the wild and no public exploit code.
Other vulnerabilities in Apache Dubbo
- CVE-2023-29234 Bypass serialize checks in Apache Dubbo
- CVE-2023-46279 Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
- CVE-2021-32824 Regular expression Denial of Service in MooTools
- CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
- CVE-2021-43297 Dubbo Hessian cause RCE when parse error
Sources
Also known as GHSA-r577-4hq7-73qh.