apache-dubbo-unauth: Apache Dubbo - Unauthenticated Access

日期: 2025-08-01 | 影响软件: Apache Dubbo | POC: 已公开

漏洞描述

Apache Dubbo Unauthenticated Access were detected.

PoC代码[已公开]

id: apache-dubbo-unauth

info:
  name: Apache Dubbo - Unauthenticated Access
  author: j4vaovo
  severity: high
  description: |
    Apache Dubbo Unauthenticated Access were detected.
  reference:
    - https://dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/auth/
  metadata:
    verified: true
    max-request: 1
    fofa-query: apache dubbo
  tags: network,dubbo,apache,unauth,misconfig,tcp,vuln
tcp:
  - inputs:
      - data: "68656c700d0a"
        type: hex

    host:
      - "{{Hostname}}"
    port: 20880
    read-size: 2048

    matchers:
      - type: word
        words:
          - "trace [service] [method] [times]"
# digest: 4b0a0048304602210087921da6797a43a399fd7d330818e9d2c40f6e65ecce90024190ae19593bdc47022100f27d0320e81fec691c2f3bd7501e4e319fce4ba5a9468b51f9c65bab1998823c:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/network/misconfig/apache-dubbo-unauth.yaml

相关漏洞推荐