CVE-2021-43297
Description
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
- CVSS Version 3.1
- CVSS Version 2.0
nvd
CVE ID: CVE-2021-43297
Base Score: 9.8
Base Severity: CRITICAL
Vector String:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
nvd
CVE ID: CVE-2021-43297
Base Score: 7.5
Base Severity: HIGH
Vector String:AV:N/AC:L/Au:N/C:P/I:P/A:P
Proof Of Concept
bitterzzZZ
CVE-2021-43297 POC，Apache Dubbo<= 2.7.13时可以实现RCE
Refrence: GitHub
longofo
Apache Dubbo Hessian2 CVE-2021-43297 demo
Refrence: GitHub