Regular expression Denial of Service in MooTools
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Dubbo | 2.6.10 to before 2.6.10; 2.7.10 to before 2.7.10; 2.7.0 and later | 2.6.10, 2.7.10 | Patch available | CNA |
| — | org.apache.dubbo:dubbo-parent (Maven) | before 2.6.10 | 2.6.10 | Patch available | GHSA-fprr-rrm8-4534 |
| — | org.apache.dubbo:dubbo-parent (Maven) | 2.7.0 to before 2.7.10 | 2.7.10 | Patch available | GHSA-fprr-rrm8-4534 |
- Dubbo VendorApache Affected 2.6.10 to before 2.6.10; 2.7.10 to before 2.7.10; 2.7.0 and later Fixed in 2.6.10, 2.7.10 Patch available CNA
- org.apache.dubbo:dubbo-parent (Maven) Vendor— Affected before 2.6.10 Fixed in 2.6.10 Patch available GHSA-fprr-rrm8-4534
- org.apache.dubbo:dubbo-parent (Maven) Vendor— Affected 2.7.0 to before 2.7.10 Fixed in 2.7.10 Patch available GHSA-fprr-rrm8-4534
Remediation
- Fix · CNA Dubbo (Apache) Fixed in 2.6.10, 2.7.10
- Fix · GHSA-fprr-rrm8-4534 org.apache.dubbo:dubbo-parent (Maven) Fixed in 2.6.10 Advisory →
- Fix · GHSA-fprr-rrm8-4534 org.apache.dubbo:dubbo-parent (Maven) Fixed in 2.7.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32824
- 2026-10-03 Alias added: GHSA-fprr-rrm8-4534
References
More Apache Dubbo vulnerabilities
- TI-2021-10721 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVSS 3.1CRITICAL 9.8
- TI-2021-10720 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVSS 3.1CRITICAL 9.8
- TI-2019-13107 Deserialization of untrusted data in Apache Dubbo CVSS 3.1CRITICAL 9.8
- TI-2021-07774 Dubbo Zookeeper does not check serialization id CVSS 3.1CRITICAL 9.8
- TI-2021-19290 Dubbo Hessian cause RCE when parse error CVSS 3.1CRITICAL 9.8
- TI-2020-01872 Deserialization of untrusted data in Apache Dubbo CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-32824 · CVE Program
- CVE-2021-32824 · NVD
- FIRST EPSS
- GHSA-fprr-rrm8-4534 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences