Dubbo Zookeeper does not check serialization id

Vulnerability

In Apache Dubbo versions before 2.7.8 or 2.6.9, a deserialization vulnerability exists in the provider server's handling of serialization protocol selection. The server normally communicates a serialization ID to clients to indicate which protocol to use. However, an attacker can tamper with byte preamble flags to override this instruction and cause the server to use a different serialization protocol than intended. If a weak deserializer such as Kryo or FST is present in the classpath (e.g., via a transitive dependency), the attacker can force the server to deserialize incoming data using that weaker protocol. The vulnerability affects all Dubbo versions prior to 2.7.8 and 2.6.9 [1].

Exploitation

The attacker does not need authentication, and exploitation is remote. The attack requires that a weak deserializer like Kryo or FST is available on the server's classpath. The attacker sends a crafted network request to the Dubbo provider with manipulated byte preamble flags that set a different serialization ID than what the server advertised. This makes the provider deserialize the payload using the chosen weak protocol. The attacker then includes a malicious serialized object designed to trigger arbitrary code execution during deserialization [1].

Impact

Successful exploitation leads to remote code execution (RCE) on the Dubbo provider server. The attacker gains full control over the server process with the privileges of the Dubbo application. This can result in complete compromise of confidentiality, integrity, and availability of the affected system [1].

Mitigation

Users should upgrade Apache Dubbo to version 2.7.8 or 2.6.9, or later, which fix the issue by ensuring the provider enforces its own serialization ID and does not accept an attacker-supplied one. If upgrading is not immediately possible, ensure that weak deserializers (such as Kryo and FST) are not on the classpath of the Dubbo provider. No workaround is otherwise available. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].