CVE-2021-32824: Apache Dubbo Remote Code Execution via Telnet Handler
Summary
CVE-2021-32824: Apache Dubbo vulnerable to remote code execution via Telnet Handler. Affects org.apache.dubbo:dubbo-parent across 2 version ranges.
< 2.6.10
>= 2.7.0, < 2.7.10
Fixed in 2.6.10 or 2.7.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Dubbo is a Java-based open-source RPC framework. It provides a flexible and efficient communication protocol for distributed systems. Dubbo allows developers to build high-performance and scalable applications by abstracting the complexity of network communication and providing various features such as load balancing, fault tolerance, and service registration. However, versions prior to 2.6.10 and 2.7.10 are vulnerable to a pre-authorization remote code execution vulnerability via arbitrary bean manipulation in the Telnet handler.
Vulnerability Detail
The Telnet handler in Apache Dubbo exposes an unprotected endpoint that can be accessed through the main service port. This handler offers methods to collect information about the providers and methods exposed by the service, and even allows for shutting down the service. An attacker can exploit this vulnerability by manipulating beans in the Telnet handler to achieve remote code execution. Additionally, the invoke handler can be used to invoke provider methods, and a flaw in the processing of call arguments allows an attacker to instantiate arbitrary classes and invoke their setters, leading to remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.102.6.10 -
>= 2.7.0, < 2.7.102.7.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to restrict access to the Dubbo main service port and the Telnet handler endpoint. This can be achieved by configuring appropriate network-level access controls or firewall rules to limit access to trusted sources only.
Conclusion
Apache Dubbo versions prior to 2.6.10 and 2.7.10 are vulnerable to a remote code execution vulnerability via the Telnet handler. It is crucial to upgrade to the patched versions or apply appropriate workarounds to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.dubbo:dubbo-parent →
FAQ
Apache Dubbo is a Java-based open-source RPC framework that provides a communication protocol for building distributed systems.
Versions prior to 2.6.10 and 2.7.10 of Apache Dubbo are vulnerable to this remote code execution vulnerability.
An attacker can exploit this vulnerability by manipulating beans in the Telnet handler or by invoking provider methods using the invoke handler, which can lead to remote code execution.
The vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or system compromise.
A temporary workaround is to restrict access to the Dubbo main service port and the Telnet handler endpoint by implementing network-level access controls or firewall rules.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dubbo:dubbo-parent.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
