PT-2024-4007 · Apache · Apache Hugegraph-Server

6Right + 2 · Published 2024-04-22 · Updated 2026-01-12 · CVE-2024-27348

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.3.0

Description: The issue affects Apache HugeGraph-Server, allowing unauthenticated remote code execution and server takeover. This flaw can be exploited by attackers to bypass sandbox restrictions, leading to remote code execution. The vulnerability has been identified in HugeGraph-Server versions 1.0.0 – 1.3.0. It is recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. The vulnerability is being actively exploited, and users are advised to take immediate action to prevent exploitation.

Recommendations: Upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. As a temporary workaround, consider disabling the vulnerable groovy injection functionality until a patch is available. Restrict access to the vulnerable gremlin endpoint to minimize the risk of exploitation. Avoid using the groovy parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Improper Access Control

Command Injection

Weakness Enumeration

CWE-284

CWE-294

CWE-77

Related Identifiers

BDU:2024-04433

CVE-2024-27348

GHSA-29RC-VQ7F-X335

Affected Products

Apache Hugegraph-Server

References · 77

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb · Exploit
• 🔥 https://github.com/Zeyad-Azima/CVE-2024-27348 · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2024-27348 · Exploit
• 🔥 https://github.com/jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE · Exploit
• 🔥 https://vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348 · Exploit
• 🔥 https://exploit-db.com/exploits/52149 · Exploit
• https://osv.dev/vulnerability/GHSA-29rc-vq7f-x335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27348 · Security Note
• https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27348 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04433 · Security Note
• https://github.com/apache/incubator-hugegraph · Note
• https://github.com/apache/incubator-hugegraph/commit/713d88d1fd9953c3c3e3f130389501910ba40e1d · Note
• https://twitter.com/transilienceai/status/1839370098756190595 · Twitter Post
• https://twitter.com/fletch_ai/status/1910890712373318068 · Twitter Post