Description
Dubbo 是一个高性能且优秀的服务框架。在 CVE-2023-23638 中，发现旧版本的 Dubbo 存在反序列化漏洞，攻击者可以在能够访问 Dubbo 服务的情况下，构造恶意请求，触发反序列化并执行任意代码。
Apache Dubbo 反序列化远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/fairyming/CVE-2019-17564
https://wxb.fzu.edu.cn/info/1015/1721.htm
https://zhuanlan.zhihu.com/p/325786993
https://www.anquanke.com/post/id/209939
https://www.cnblogs.com/twosmi1e/p/14765893.html
https://cloud.tencent.com/developer/article/2315009
https://l3yx.github.io/2020/08/25/Apache-Dubbo-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E7%AC%94%E8%AE%B0/
https://it.shanghaitech.edu.cn/2022/0113/c8406a271796/page.htm
https://rivers.chaitin.cn/blog/cq94i4p0lnechd243e8g
https://nosec.org/m/share/4484.html
https://security.zone.ci/aliyun/ali_highrisk/303608.html
https://blog.nsfocus.net/apache-dubbo-cve-2021-43297/
https://xxb.sus.edu.cn/info/1068/2743.htm
https://www.sevenyuan.cn/2020/07/21/java/2020-07-21-dubbo-cve-2020-1948/
https://tttang.com/archive/1730/
https://blog.csdn.net/yyj1781572/article/details/129909018
https://whoopsunix.com/docs/components/Dubbo/CVE-2021-43297
https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2021-43297-notification/
https://www.sangfor.com/blog/cybersecurity/apache-dubbo-deserialization-remote-code-execution-vulnerability-cve-2020-1948
https://github.blog/security/vulnerability-research/apache-dubbo-all-roads-lead-to-rce/
https://nvd.nist.gov/vuln/detail/CVE-2023-23638
https://checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability/