Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Vulnerability

Apache Dubbo versions prior to 2.6.9 and 2.7.9 include a Script routing feature that uses the Java ScriptEngine to parse and execute user-provided routing rules. When a request is made, these rules are evaluated without proper sandboxing, allowing arbitrary code execution. The vulnerability exists in the script routing functionality which is enabled by default [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted request containing a malicious script rule. No authentication is required, as the script rules are supplied as part of the request. The ScriptEngine then executes the attacker-controlled script in the context of the Dubbo server [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Dubbo server process. This can lead to full system compromise, including data exfiltration, installation of malware, or lateral movement within the network [1].

Mitigation

Upgrade to Apache Dubbo version 2.6.9 or 2.7.9, which fix the issue by removing support for script routing or adding proper sandboxing. As of the publication date, no workaround is available for unpatched versions [1]. This CVE is not listed in the known exploited vulnerabilities (KEV) catalog.