Bypass deserialization checks in Apache Dubbo

Vulnerability

The vulnerability exists in Apache Dubbo's provider component, where the server checks incoming requests and their serialization type against the configured allowed types. However, an exception in the check logic allows an attacker to bypass this security check when enabled, reaching a deserialization operation using native Java serialization. This affects versions prior to 2.7.13 and 3.0.2 [1].

Exploitation

An attacker can send a crafted request with an unrecognized serialization type that triggers the exception, skipping the security check. The attacker does not need authentication but must be able to send network requests to the Dubbo provider. The exploitation sequence involves sending a malicious serialized payload using native Java serialization, which the provider then deserializes [1].

Impact

Successful exploitation leads to arbitrary code execution via unsafe deserialization of untrusted data. The attacker gains full control over the affected Dubbo provider, potentially compromising the entire application and its data [1].

Mitigation

The issue is fixed in Apache Dubbo versions 2.7.13 and 3.0.2, which quickly fail when any unrecognized request is found. Users should upgrade to these versions or later. The Apache Dubbo project [2] provides the fixed versions. No workarounds are mentioned in the references. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1].