Apache HugeGraph reports critical flaw, POC exploit code published
Take action: If you are using Apache HugeGraph, perform a risk assessment to identify how easy it is to exploit your implementation. That includes testing the PoC exploits. Then plan for a quick patch.
Learn More
A critical remote code execution (RCE) vulnerability, tracked as CVE-2024-27348 is reported in Apache HugeGraph, a popular open-source graph database used in Java 8 and Java 11 environments.
CVE-2024-27348 (CVSS Score 9.8) is caused by missing reflection filtering in the SecurityManager, which can be exploited using specially crafted Gremlin commands. This allows attackers to bypass sandbox restrictions and achieve remote code execution, to full server control, data theft or ransomware deployment.
Affected Versions are Apache HugeGraph-Server 1.0.0 up to, but not including, 1.3.0. The flaw is fixed in version: 1.3.0
To mitigate this vulnerability, users should upgrade to version 1.3.0, use Java 11 and enable the Auth system and enable the Whitelist-IP/port function to improve RESTful-API execution security.
Security researcher Milan Jovic's has published an PoC exploitAllows unauthenticated users to execute OS commands on vulnerable versions.
Given the severity of this vulnerability and the availability of POC exploit code, users should upgrade to the latest version immediately.
