{"id":"CVE-2019-17564","published":"2020-04-01T21:17:59Z","modified":"2024-08-05T01:40:15Z","title":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled","vendor":"Apache","product":"Apache Dubbo","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache","product":"Apache Dubbo","versions":["2.7.0 to 2.7.4","2.6.0 to 2.6.7","all 2.5.x versions"]}],"description":{"text":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.36513,"percentile":0.98487,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-10","exploitedFirstSeen":"2024-05-10","ransomware":false,"evidence":[{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"GitHub - nautilus-aqua/Kinsing-Indication-of-Compromise: This repo contains indication of compromise of Kinsing threat actor that were collected over a period of few years","url":"https://otx.alienvault.com/pulse/67ba26921050c137f83c3b8d","created":"2025-02-22"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4275","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.dubbo:dubbo-rpc-http-invoker","vulnerableRanges":[">=2.5.0, <2.7.5"],"patched":["2.7.5"],"from":["GHSA-69wp-3pm3-hxgg"],"provenance":"source"}],"advisories":[{"id":"GHSA-69wp-3pm3-hxgg","url":"https://github.com/advisories/GHSA-69wp-3pm3-hxgg","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.dubbo:dubbo-rpc-http-invoker","vulnerableRanges":[">=2.5.0, <2.7.5"],"patched":["2.7.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2765","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2765","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":2,"earliest":"2020-02-13","earliestUrl":"https://github.com/Jaky5155/CVE-2019-17564","repos":[{"name":"Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget","url":"https://github.com/Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget","stars":16,"created":"2020-02-20"},{"name":"fairyming/CVE-2019-17564","url":"https://github.com/fairyming/CVE-2019-17564","stars":8,"created":"2020-02-24"},{"name":"Jaky5155/CVE-2019-17564","url":"https://github.com/Jaky5155/CVE-2019-17564","stars":2,"created":"2020-02-13"},{"name":"Hu3sky/CVE-2019-17564","url":"https://github.com/Hu3sky/CVE-2019-17564","stars":1,"created":"2020-02-14"},{"name":"CyberCTF/vulhub-dubbo-cve-2019-17564","url":"https://github.com/CyberCTF/vulhub-dubbo-cve-2019-17564","stars":0,"created":"2026-10-08"}]},"nuclei":[{"id":"CVE-2019-17564","name":"Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization","severity":"critical","path":"http/cves/2019/CVE-2019-17564.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17564.yaml"}],"first":{"date":"2020-02-13","source":"PoC-in-GitHub","url":"https://github.com/Jaky5155/CVE-2019-17564"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-02-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Jaky5155/CVE-2019-17564","provenance":"source"},{"date":"2020-04-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-17564","provenance":"source"},{"date":"2024-05-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":60.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 902 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.7,"detail":"percentile 0.9849"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}