Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-30181

Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Dubbo

  • Apache Dubbo 2.7.x to < 2.7.9affected
  • Apache Dubbo 2.6.x to < 2.6.9affected

References