Critical Apache HugeGraph Vulnerability Under Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-27348 | Unauthenticated RCE in Apache HugeGraph-Server 1.0.0-1.2.x Apache HugeGraph-Server versions 1.0.0 through versions before 1.3.0 contain an improper access control flaw (CWE-284) that enables unauthenticated remote code execution through the server's network-facing API when the authentication system is not enabled. An attacker with network access to a vulnerable server can send crafted requests that execute arbitrary commands on the host with no credentials, privileges, or user interaction required, consistent with the CVSS 9.8 network/low-complexity vector. All deployments of HugeGraph-Server 1.0.0-1.2.x running on Java 8 or Java 11 are affected, especially instances exposed to untrusted networks with auth disabled. Exploitation is active: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-18, public reporting says it is under attack, and EPSS assigns a 99.2% probability of exploitation within 30 days (100th percentile). CISA's required action is to apply vendor mitigations per vendor instructions or discontinue use of the product. Do: Upgrade to Apache HugeGraph-Server 1.3.0 running on Java 11 and enable the authentication (Auth) system, which fixes the issue per the vendor. If upgrading is not immediately possible, restrict network access to the HugeGraph-Server API to trusted clients and enable auth, and audit internet-exposed instances for signs of exploitation. Because this flaw is in CISA's KEV catalog, federal agencies and other bound organizations must apply the vendor mitigations or discontinue use by the required deadline. | 9.8 | 99% | KEV PoC |
| nichelikely only thousands of internet-exposed instances at most |
Full article260 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 17, 2024Vulnerability / Data Security
Threat actors are actively exploiting a recently disclosed critical security flaw impacting Apache HugeGraph-Server that could lead to remote code execution attacks.
Tracked as CVE-2024-27348 (CVSS score: 9.8), the vulnerability impacts all versions of the software before 1.3.0. It has been described as a remote command execution flaw in the Gremlin graph traversal language API.
"Users are recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system, which fixes the issue," the Apache Software Foundation noted in late April 2024. "Also you could enable the 'Whitelist-IP/port' function to improve the security of RESTful-API execution."
Additional technical specifics about the flaw were released by penetration testing company SecureLayer7 in early June, stating it enables an attacker to bypass sandbox restrictions and achieve code execution, giving them complete control over a susceptible server.
This week, the Shadowserver Foundation said it spotted in-the-wild exploitation attempts that leverage the flaw, making it imperative that users move quickly to apply the latest fixes.
"We are observing Apache HugeGraph-Server CVE-2024-27348 RCE 'POST /gremlin' exploitation attempts from multiple sources," it said. "[Proof-of-concept] code is public since early June. If you run HugeGraph, make sure to update."
Vulnerabilities discovered in Apache projects have been lucrative attack vectors for the nation-state and financially motivated threat actors in recent years, with flaws in Log4j, ActiveMQ, and RocketMQ coming under heavy exploitation to infiltrate target environments.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/07/critical-apache-hugegraph-vulnerability.html