How to analyze Apache Dubbo antisequence vulnerability CVE-2019-17564

How to analyze Apache Dubbo anti-sequence vulnerability CVE-2019-17564, I believe that many inexperienced people do not know what to do about it. Therefore, this paper summarizes the causes and solutions of the problem. Through this article, I hope you can solve this problem.

Introduction to 0x01

Apache Dubbo is a high-performance, lightweight open source Java RPC framework that provides three core capabilities: interface-oriented remote method invocation, intelligent fault tolerance and load balancing, and automatic service registration and discovery.

Overview of 0x02 vulnerabilities

A deserialization vulnerability in the Apache Dubbo HTTP protocol (CVE-2019-17564), which is mainly due to insecure deserialization caused by improper handling of the message body by Apache Dubbo when the HTTP protocol is enabled by Apache Dubbo, which can lead to remote code execution when gadgets is available in the project package.

0x03 affects version

2.7.0