Unprotected yaml deserialization cause RCE

Vulnerability

Apache Dubbo implements routing and configuration override rules using YAML, which are stored in a configuration center (e.g., Zookeeper, Nacos). When consumers retrieve these rules, the SnakeYAML library parses them. By default, SnakeYAML enables the invocation of arbitrary constructors, allowing deserialization of arbitrary classes. This vulnerability affects Dubbo versions prior to 2.7.13 and 3.0.2. An attacker must have write access to the configuration center to inject a malicious rule [1].

Exploitation

An attacker with access to the configuration center can poison a YAML rule by embedding a SnakeYAML gadget chain. When a consumer fetches and parses the poisoned rule, SnakeYAML instantiates the specified classes, leading to remote code execution (RCE). No user interaction is required beyond the normal rule retrieval process [1].

Impact

Successful exploitation allows remote code execution on all Dubbo consumers that load the malicious rule. The attacker gains full control over the affected consumer processes, potentially leading to data exfiltration, lateral movement, or further compromise [1].

Mitigation

Apache Dubbo fixed this vulnerability in versions 2.7.13 and 3.0.2. Users should upgrade to these versions or later. As a workaround, restrict write access to the configuration center to trusted entities only. No other mitigations are provided in the available references [1].