WaratekVRT Sign in

CVE-2021-32824 Apache Dubbo

Affected softwareApache Dubbo
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in2.6.10, 2.7.10
WeaknessDeserialization of untrusted data (CWE-502)
Published3 Jan 2023
Updated17 Jun 2026

Description

Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the invoke handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with PojoUtils.realize which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, PojoUtils.realize is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 3.4% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H security-advisories@github.com Secondary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.dubbo:dubbo-parent 0 2.6.10 unbounded
org.apache.dubbo:dubbo-parent 2.7.0 2.7.10 unbounded

Products and versions

2 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd apache dubbo generic ＜ 2.6.10 · ≥ 2.7.0 and ＜ 2.7.10
osv org.apache.dubbo dubbo-parent generic ＜ 2.6.10 · ≥ 2.7.0 and ＜ 2.7.10

References

URLTags
https://github.com/apache/dubbo PACKAGE
https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo ADVISORY
https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/ Exploit, Third Party Advisory

Timeline
Published2023-01-03By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.