PT-2024-20490 · Apache · Apache Hop Engine

Jonathan Leitschuh · Published 2024-03-18 · Updated 2025-07-15 · CVE-2024-24683

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Hop Engine versions prior to 2.8.0

Description The issue is related to improper input validation in the Apache Hop Engine, specifically affecting the Hop Server component. When the Hop Server writes links to the PrepareExecutionPipelineServlet page, one of the parameters provided to the user, the id, is not properly escaped. This makes the risk of exploiting this issue low, as the id is not directly accessible by users creating pipelines. The issue does not directly affect the client.

Recommendations For Apache Hop Engine versions prior to 2.8.0, users are recommended to upgrade to version 2.8.0, which fixes the issue. As a temporary workaround, consider restricting access to the PrepareExecutionPipelineServlet page until the upgrade is applied. Additionally, users can minimize the risk of exploitation by being cautious when creating pipelines and avoiding any potential manipulation of the id variable.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-24683

GHSA-F6G6-PJGC-5CJ5

Affected Products

Apache Hop Engine

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-24683 · Security Note
• https://lists.apache.org/thread/ts203zssv1n9qth1wdlhk2bhos3vcq6t · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24683 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6g6-pjgc-5cj5 · Vendor Advisory
• https://github.com/apache/hop · Note
• https://twitter.com/VulmonFeeds/status/1769847087028379906 · Twitter Post
• https://twitter.com/RedPacketSec/status/1770028593701134651 · Twitter Post
• https://t.me/cvenotify/129004 · Telegram Post
• https://twitter.com/oss_security/status/1769826654413541562 · Twitter Post
• http://openwall.com/lists/oss-security/2024/03/18/1 · Note
• https://twitter.com/CVEnew/status/1770006780455587924 · Twitter Post
• https://t.me/cvenotify/74232 · Telegram Post