CVE-2021-37579: 
Java vulnerability analysis and mitigation

Apache Dubbo prior to version 3.0.0 contains a pre-authentication unsafe Java deserialization vulnerability (CVE-2021-37579). The vulnerability was discovered and reported by GHSL team member @pwntester (Alvaro Muñoz) on June 28, 2021, and was fixed on August 17, 2021 (GitHub Security Lab).

The vulnerability exists in Apache Dubbo's deserialization checks implementation. The security check (serialization.security.check) introduced in version 2.6.10.1 to prevent consumers from changing the serialization type can be bypassed. An attacker can control both the path and version arguments passed to checkSerialization() and provide a legitimate path with a non-existent version, causing the security check to fail silently. This allows the attacker to effectively change the serialization type to native Java, bypass the security check, and reach an unsafe deserialization operation (GitHub Security Lab).

This vulnerability may lead to pre-authentication Remote Code Execution (RCE) when successfully exploited (GitHub Security Lab).

The vulnerability requires an attacker to send a valid path that makes repository.lookupService(path) return a valid ServiceDescriptor while making repository.lookupExportedServiceWithoutGroup(path + ":" + version) fail. This allows bypassing the security check and reaching the unsafe deserialization operation (GitHub Security Lab).

The issue was fixed in Apache Dubbo version 3.0.0. Users should upgrade to this version or later to address the vulnerability (GitHub Security Lab).