Apache Dubbo CVE-2020-1948 Test Environment

Introduction

When this vulnerability first emerged, in order to verify its impact, we searched the internet for many examples compiled by others, but found none that could successfully validate it. So we created one ourselves and put it here for your reference. Welcome to exchange ideas!

This environment is adapted from the official Apache Dubbo sample environment, correcting several compilation errors that occurred in the official sample program. For example:

• The DubboService class used in the official sample code should actually be Service.

Compilation

cd src
mvn package

After successful compilation, the file dubbo.jar will be generated in the src/target directory.

Running

java -jar target/dubbo.jar

After successful execution, it listens on port 12345. You can use the telnet command to connect and test.

telnet x.x.x.x 12345
# dubbo> ls -l
# PROVIDER:
#     org.apache.dubbo.spring.boot.sample.consumer.DemoService:1.0.0 ->  published: N

Containerization

# Build
docker build -t dsolab/dubbo:cve-2020-1948 .

# Run
docker run -p 12345:12345 dsolab/dubbo:cve-2020-1948 -d
or
docker-compose up -d

# Access
telnet x.x.x.x 12345

If you just want to quickly use the environment (too lazy to compile), you can start the image environment we provide with the following command:

# Docker and docker-compose need to be installed
docker-compose up -d

Vulnerability Verification

See Apache Dubbo CVE-2020-1948 Deserialization Vulnerability Verification Method

Reference Links

• Dubbo Spring Boot Project

https://github.com/apache/dubbo-spring-boot-project/

• Dubbo Pull Request

https://github.com/apache/dubbo/pull/6374

• Dubbo Mail Archive

https://www.mail-archive.com/[email protected]/msg06544.html