CVEs-PoC/2021/CVE-2021-30180.md

CVE-2021-30180

Description

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Armandhe-China/ApacheDubboSerialVuln
• https://github.com/Whoopsunix/PPPVULNS
• https://github.com/dayutech/ApacheDubboSerialVuln
• https://github.com/shoucheng3/apache__dubbo_CVE-2021-30180_2-7-9