Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-25641 PoC — Dubbo Zookeeper does not check serialization id

Source
https://github.com/Dor-Tumarkin/CVE-2021-25641-Proof-of-Concept
Associated Vulnerability
Title:Dubbo Zookeeper does not check serialization id (CVE-2021-25641)
Description:Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
Description
Apache/Alibaba Dubbo <= 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions <= 2.7.6 With Different Gadgets
Readme
# The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept
Apache/Alibaba Dubbo &lt;= 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions &lt;= 2.7.6 With Different Gadgets

Covered in-depth in the article "The 0xDABB of Doom", published on the Checkmarx blog
https://www.checkmarx.com/blog/technical-blog/the-0xdabb-of-doom-cve-2021-25641/
File Snapshot

 [4.0K]  /data/pocs/1839da48af8c41cbe0d366552089dab7f6c77a38
├── [4.0K]  DubboProtocolExploit
│   ├── [2.1K]  pom.xml
│   └── [4.0K]  src
│       └── [4.0K]  main
│           └── [4.0K]  java
│               ├── [4.0K]  DubboProtocolExploit
│               │   ├── [6.5K]  Main.java
│               │   └── [9.3K]  Utils.java
│               └── [4.0K]  org
│                   └── [4.0K]  apache
│                       └── [4.0K]  dubbo
│                           └── [4.0K]  demo
│                               └── [ 108]  DemoService.java
└── [ 379]  README.md

9 directories, 5 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →