Intrusion PreventionApache.Dubbo.HttpRemoteInvocation.Insecure.Deserialization
Description
This indicates an attack attempt to exploit an Insecure Deserialization Vulnerability in Apache Software Foundation Dubbo.
This vulnerability is due to improper handling of the HTTP request messages by the Apache Dubbo application that has HTTP remoting enabled. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the target server. Successful exploitation results in arbitrary code execution with the privileges of the application.
Affected Products
Apache Software Foundation Dubbo 2.6.0 to 2.6.7
Apache Software Foundation Dubbo 2.7.0 to 2.7.4
Apache Software Foundation Dubbo all 2.5.x versions
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://github.com/apache/dubbo/releases/tag/dubbo-2.7.5
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| ID | 48919 |
| Created | May 07, 2020 |
| Updated | Sep 23, 2020 |
| CVE ID | |
| Risk |
|
| Exploit Prediction Score | 94.05% |
| Default Action | drop |
| Active | |
| Affected OS | Linux |
| Affected App | Apache |
| Profile Type | Permission/Privilege/Access Control |