Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to...
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
dubbo/CVE-2019-17564
Aapche Dubbo Unsafe Java Deserialization (CVE-2019-17564)
http/cves/2019/CVE-2019-17564.yaml
Basic code for creating the Alibaba FastJson + Spring gadget chain, as used to exploit Apache Dubbo in CVE-2019-17564 - more information available at https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability
CVE-2019-17564：Apache Dubbo反序列化漏洞
Proof-of-concept exploit for CVE-2019-17564 targeting a remote code execution vulnerability in Apache Dubbo. Designed for security testing and vulnerability validation.
CVE-2019-17564 : Apache Dubbo Deserialization Remote Code Execution
CVE-2019-17564 Apache Dubbo deserialization RCE
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.