CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass

What is CVE-2023-23638?

CVE-2023-23638 is a medium-severity unsafe deserialization vulnerability in Apache Dubbo, published on 8 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.

This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

Weakness: CWE-502

Which versions are affected by CVE-2023-23638?

6 open source packages ship an affected version, including org.apache.dubbo:dubbo. It affects 1 product.

Products include Apache Dubbo.

How do I fix CVE-2023-23638?

Upgrade org.apache.dubbo:dubbo to a fixed version for your release line: 2.7.22, 3.0.13 or 3.1.5.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-23638 being exploited?

There is no known exploitation of CVE-2023-23638 in the wild and no public exploit code.

Public exploit code: 4 proofs of concept on GitHub.

Other vulnerabilities in Apache Dubbo

• CVE-2023-29234 Bypass serialize checks in Apache Dubbo Critical 9.8
• CVE-2023-46279 Apache Dubbo: Bypass deny serialize list check in Apache Dubbo Critical 9.8
• CVE-2021-32824 Regular expression Denial of Service in MooTools Critical 9.8
• CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass Critical 9.8
• CVE-2021-43297 Dubbo Hessian cause RCE when parse error Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-933g-v89r-x8pf.