Apache Dubbo Remote Code Execution Vulnerability (CVE-2020-1948): Background, Risk Assessment, Affected Versions, and Mitigation

0x01 Vulnerability Background

On June 23, 2020, 360CERT detected that Apache Dubbo released a security advisory for a remote code execution vulnerability (CVE-2020-1948) classified as high severity.

Apache Dubbo is a high‑performance, lightweight open‑source Java RPC framework offering three core capabilities: interface‑based remote method invocation, intelligent fault tolerance and load balancing, and automatic service registration and discovery.

The Dubbo provider suffers from a deserialization flaw that allows attackers to send crafted RPC requests containing unrecognizable service or method names and malicious payloads; when deserialized, these payloads can lead to remote code execution.

Technical details of the vulnerability have been publicly disclosed.

360CERT recommends users promptly apply the latest patches, conduct asset inventories, and implement preventive measures to avoid exploitation.

0x02 Risk Rating

360CERT’s assessment of the vulnerability is as follows:

Assessment Method

Level

Threat Level

High

Impact Scope

Wide

0x03 Vulnerability Details

The Dubbo provider’s deserialization vulnerability enables remote code execution when malicious parameters are deserialized.

0x04 Affected Versions

Dubbo 2.7.0 – 2.7.6

Dubbo 2.6.0 – 2.6.7

Dubbo 2.5.x (no longer maintained)

0x05 Mitigation Recommendations

General remediation advice:

Upgrade to Dubbo 2.7.7 or later. Download link:

https://github.com/apache/dubbo/releases/tag/dubbo-2.7.7

0x06 Related Asset Mapping Data

360 Security Brain’s Quake cyberspace mapping system shows extensive domestic usage of Dubbo, as illustrated below.

0x07 Product‑Side Solutions

360 City‑Level Network Security Monitoring Service

360 Security Brain’s QUake asset mapping platform monitors such vulnerabilities; users can contact the relevant product team for solutions.

0x08 Timeline

2020‑06‑22 Apache Dubbo official advisory released

2020‑06‑23 360CERT issued warning