Unsafe deserialization in providers using the Hessian protocol

Vulnerability

The vulnerability resides in Apache Dubbo's Hessian protocol implementation. The Hessian protocol passes the body of a POST request directly to a HessianSkeleton without any configuration of the serialization factory, thus failing to apply allowed or blocked type lists. Additionally, the generic service is always exposed, so attackers do not need to know a valid service/method name pair. Affected versions are before 2.7.13 and 2.6.10.1 [1].

Exploitation

An unauthenticated attacker can send a crafted POST request to the Dubbo server using the Hessian protocol. Because the generic service is always exposed, no prior knowledge of valid service endpoints is required. The attacker can exploit deserialization by providing malicious serialized data, leading to remote code execution [1].

Impact

Successful exploitation allows remote code execution on the Dubbo server. This results in full compromise of the affected system, including loss of confidentiality, integrity, and availability [1].

Mitigation

Fixed in Apache Dubbo versions 2.7.13 and 2.6.10.1 [3][4]. Users should upgrade to these or later versions. No workarounds are mentioned in the available references [1].