CVE-2024-27348 Apache HugeGraph-Server Improper Access Control
Attackers can execute arbitrary commands via Gremlin queries in Apache HugeGraph-Server, requiring authentication to be enabled for mitigation.
- Exploited in the wild
- Since 18 Sep 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27348?
CVE-2024-27348 is a critical code injection vulnerability in Apache HugeGraph-Server, published on 22 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
Weakness: CWE-284
Which versions are affected by CVE-2024-27348?
4 open source packages ship an affected version, including org.apache.hugegraph:hugegraph-api and org.apache.hugegraph:hugegraph-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hugegraph:hugegraph-api Maven | From 1.0.0 | 1.3.0 |
org.apache.hugegraph:hugegraph-api Maven | From 1.0.0 | 1.3.0 |
org.apache.hugegraph:hugegraph-core Maven | From 1.0.0 | 1.3.0 |
org.apache.hugegraph:hugegraph-core Maven | From 1.0.0 | 1.3.0 |
Products include Apache Hugegraph.
How do I fix CVE-2024-27348?
Upgrade org.apache.hugegraph:hugegraph-api to 1.3.0 or later. US federal agencies must fix it by 9 Oct 2024.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-27348 being exploited?
Yes. Attackers have exploited CVE-2024-27348 in the wild since at least 18 Sep 2024.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 6 proofs of concept on GitHub.
Other vulnerabilities in Apache HugeGraph-Server
Sources
Also known as GHSA-29rc-vq7f-x335.