Dubbo Hessian cause RCE when parse error

Vulnerability

A deserialization vulnerability exists in the hessian-lite library (version 3.2.11 and earlier) used by Apache Dubbo [1]. When a Hessian deserialization operation catches an unexpected exception, the library logs detailed information about the exception in a way that can be exploited to achieve remote code execution. The affected Apache Dubbo versions are: 2.6.x prior to 2.6.12, 2.7.x prior to 2.7.15, and 3.0.x prior to 3.0.5 [1].

Exploitation

An attacker needs to be able to send crafted serialized data to a Dubbo service that uses the default Hessian2 protocol. The exploit triggers an unexpected exception during deserialization, causing the Hessian library to log specific information that is then interpreted in an unsafe manner, leading to command execution [1]. No authentication is mentioned as a prerequisite in the description, making the attack potentially unauthenticated over the network.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the server running the vulnerable Dubbo instance. This leads to a full compromise of the confidentiality, integrity, and availability of the affected system [1].

Mitigation

Apache Dubbo users should upgrade to the fixed versions: 2.6.12, 2.7.15, or 3.0.5 (or later) for the respective branches [1]. No workaround or EOL status is mentioned in the available reference [1]. The CVE is not listed in the known exploited vulnerabilities (KEV) catalog as per the reference.