CVE-2021-32824

Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.

• CWE-502

• https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/Exploit, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/Exploit, Third Party Advisory

Published

Jan 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32819Squirrelly is a template engine implemented in JavaScript th…8.8
• CVE-2021-3282HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove…7.5
• CVE-2021-32820Express-handlebars is a Handlebars view engine for Express. …8.6
• CVE-2021-32821MooTools is a collection of JavaScript utilities for JavaScr…7.5
• CVE-2021-32822The npm hbs package is an Express view engine wrapper for Ha…5.3
• CVE-2021-32823In the bindata RubyGem before version 2.4.10 there is a pote…3.7
• CVE-2021-32825bblfshd is an open source self-hosted server for source code…9.1
• CVE-2021-32826Proxyee-Down is open source proxy software. An attacker bein…8.1
• CVE-2021-32827MockServer is open source software which enables easy mockin…9.6
• CVE-2021-32828The Nuxeo Platform is an open source content management plat…6.1
• CVE-2021-32829ZStack is open source IaaS(infrastructure as a service) soft…9.9
• CVE-2021-3283HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and j…7.5