Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

Vulnerability

Overview

CVE-2022-39198 is a deserialization vulnerability in the hessian-lite library used by Apache Dubbo. Versions 3.2.12 and earlier of hessian-lite fail to properly validate serialized objects before deserialization, allowing an attacker to inject malicious data that can trigger arbitrary code execution on the server [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted serialized object to a Dubbo service that uses the vulnerable hessian-lite library. No authentication is required if the service is exposed to untrusted networks; the attacker only needs network access to a Dubbo endpoint that accepts serialized payloads [1].

Impact

Successful exploitation leads to remote code execution (RCE) with the privileges of the Dubbo process. This can result in full compromise of the affected system, including data theft, service disruption, or lateral movement within the network [1].

Mitigation

The vulnerability is fixed in hessian-lite version 3.2.13 [3]. Apache Dubbo users should upgrade to Dubbo 2.7.18+, 3.0.12+, or 3.1.1+, which include the patched hessian-lite library [4]. No workarounds are available; upgrading is the recommended action.