{"id":81281,"date":"2021-09-21T06:51:54","date_gmt":"2021-09-21T13:51:54","guid":{"rendered":"https:\/\/github.blog\/?p=81281"},"modified":"2024-11-21T07:23:14","modified_gmt":"2024-11-21T15:23:14","slug":"apache-dubbo-all-roads-lead-to-rce","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/vulnerability-research\/apache-dubbo-all-roads-lead-to-rce\/","title":{"rendered":"Apache Dubbo: All roads lead to RCE"},"content":{"rendered":"\n

During an audit of Apache Dubbo v2.7.8 source code, I found multiple vulnerabilities<\/a> enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers. I’ve been planning a blog post for awhile (and was encouraged by all the Twitter feedback<\/a>), but it was delayed when I found four new RCEs that I reported to the Apache Dubbo project – I wanted to make sure they had ample time to remediate them.<\/p>\n

CodeQL<\/a> is GitHub’s semantic code analysis engine that lets you query code as though it were data, allowing you to find variants of a given vulnerability pattern. In this blog post, I’ll summarize the process I used to find these vulnerabilities and how I used CodeQL, not as an automated scanner to find occurrences of a specific vulnerability pattern, but rather as an audit oracle which helped me answer questions about the codebase as I was exploring it. This is not a blog post about performing variant analysis or writing a query to detect the issues I previously found through manual review, but rather about leveraging CodeQL as a codebase exploration tool to accelerate my audit. As you’ll see throughout this post, the issues I found could have been found by CodeQL automatically if third-party libraries such as Netty or Apache curator were modelled by CodeQL libraries which was not the case at the time of the audit.<\/p>\n

I assume that you have a basic level of familiarity with CodeQL. We won’t get into the details of most of the queries but they’re straightforward enough to be understood by anyone with a basic knowledge of CodeQL.<\/p>\n

Dubbo 101: what is it and who uses it<\/span><\/a><\/h2>\n

Apache Dubbo is a high-performance, Java-based, open-source RPC framework with over 35K stars on GitHub. It’s one of the most popular Apache Foundation projects.<\/p>\n

The main components of the Dubbo architecture<\/a> are:<\/p>\n