CVE-2021-30181: Code Injection in Apache Dubbo
Summary
CVE-2021-30181: Code injection in Apache Dubbo. Affects com.alibaba:dubbo versions >= 2.5.0, < 2.6.9. Fixed in 2.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Dubbo is an open-source, high-performance, and lightweight Java RPC framework. It provides distributed service capabilities for building scalable and reliable applications. Dubbo supports Script routing, allowing customers to route requests to the appropriate server. These routing rules are used by customers to find the correct endpoint when making a request. However, a vulnerability in Dubbo versions prior to 2.6.9 and 2.7.10 enables code injection through the ScriptEngine used to parse these rules. This allows for the execution of arbitrary code.
Vulnerability Detail
The vulnerability in Apache Dubbo allows an attacker to inject malicious code through the Script routing feature. By exploiting this vulnerability, an attacker can execute arbitrary code on the server hosting the Dubbo service. This can lead to various consequences, including unauthorized access, data leakage, and remote code execution. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
2.6.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to the fixed version is not immediately feasible, it is recommended to disable the Script routing feature in Dubbo configurations. This can be achieved by removing or commenting out any routing rules that utilize the ScriptEngine. By doing so, the risk of code injection through this vulnerability can be mitigated.
Conclusion
The code injection vulnerability in Apache Dubbo can have severe consequences, including unauthorized access and remote code execution. It is crucial to upgrade to the fixed versions of Apache Dubbo (2.6.9 or 2.7.10) to mitigate this vulnerability. If immediate upgrading is not possible, disabling the Script routing feature can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.alibaba:dubbo →
FAQ
Apache Dubbo is a Java RPC framework that provides distributed service capabilities for building scalable and reliable applications.
Script routing in Apache Dubbo allows customers to define routing rules using scripts to determine the appropriate server for a request.
The code injection vulnerability in Apache Dubbo is caused by the use of ScriptEngine to parse routing rules. If these rules are not properly validated, an attacker can inject malicious code.
Exploiting this vulnerability can lead to unauthorized access, data leakage, and remote code execution on the server hosting the Dubbo service.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
