cuijiung/dubbo-cve-2023-23638PoC exploit for Apache Dubbo CVE-2023-23638, a Hessian deserialization vulnerability enabling JNDI injection. Includes analysis articles and requires ZooKeeper and Java 8 for testing.
For educational purposes only
ZooKeeper required
Tested on Java 8. Other versions have not been tested and are not guaranteed to work.
To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see https://su18.org/post/hessian/#serializable
Analysis article: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/
The essence of the POC is to use a certain class to modify properties to bypass restrictions. The provided code is for JNDI injection. You can refer to CVE-2023-23638 Apache Dubbo JavaNative反序列化漏洞分析 to modify it into a deserialization exploit method.
