Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

Vulnerability

Apache Dubbo versions prior to 2.6.9 and 2.7.9 support generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter, which finds the service and method specified in the first arguments of the invocation and uses Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the method name, the second is an array of parameter types, and the third is an array of actual call arguments. An attacker can set an RPC attachment specifying that the call is generic and how to decode the arguments, with possible values such as nativejava, raw.return, bean, protobuf-json, and true. By controlling this attachment and setting it to nativejava, the attacker forces Java deserialization of the byte array in the third argument. [1]

Exploitation

An attacker who can send RPC requests to a Dubbo provider can set the RPC attachment to nativejava, causing the provider to deserialize attacker-controlled byte arrays using Java deserialization. No authentication is required if the service is exposed publicly. The attacker crafts a malicious serialized Java object as the third argument of the $invoke or $invokeAsync call. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary code on the Dubbo provider server, achieving full remote code execution (RCE) with the privileges of the Dubbo process. This leads to complete compromise of the confidentiality, integrity, and availability of the application and its data. [1]

Mitigation

This vulnerability is fixed in Apache Dubbo versions 2.6.9 and 2.7.9, released in 2021. Users of affected versions should upgrade immediately. There are no known workarounds. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date. [1]