CVE-2023-23638 Security Details

CVE ID

CVE-2023-23638

CWE

CWE-502

CVE Description

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

Published

Mar 13, 2023

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

50.291%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/dubbo/common/beanutil/JavaBeanSerializeUtil.name2Class(Ljava/lang/ClassLoader;Ljava/lang/String;)Ljava/lang/Class;

JVMVulnerable params: 0

org/apache/dubbo/common/serialize/fastjson2/FastJson2Serialization.deserialize(Lorg/apache/dubbo/common/URL;Ljava/io/InputStream;)Lorg/apache/dubbo/common/serialize/ObjectInput;

JVMVulnerable params: 1

org/apache/dubbo/common/serialize/hessian2/Hessian2Serialization.deserialize(Lorg/apache/dubbo/common/URL;Ljava/io/InputStream;)Lorg/apache/dubbo/common/serialize/ObjectInput;

JVMVulnerable params: 1

org/apache/dubbo/common/utils/PojoUtils.realize0(Ljava/lang/Object;Ljava/lang/Class;Ljava/lang/reflect/Type;Ljava/util/Map;)Ljava/lang/Object;

JVM

org/apache/dubbo/common/utils/SerializeClassChecker.<init>()V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-933g-v89r-x8pfTHIRD_PARTY

Apache · AnnouncementTHIRD_PARTY