[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)
TigerGraph Community Edition 4.2.4 default credentials and GSQL file write enable unauthenticated SSH command execution.
0day Rubbish publicly disclosed a CVSS 9.8 issue in TigerGraph Community Edition 4.2.4 combining shipped default credentials (CWE-798) with a GSQL TO_CSV arbitrary file write. The chain yields SSH command execution as the tigergraph service user (uid 1001), which owns the engine, graph data, catalog, and configuration. The advisory treats the issue as reachable without a separately created account. No CVE identifier is given in the post.
- TigerGraph Community Edition 4.2.4 ships default credentials
- GSQL TO_CSV arbitrary file write chains to SSH command execution
- CVSS 9.8; commands run as tigergraph user uid 1001
- No prior account is required beyond the shipped defaults
- Vendors
- TigerGraph
- Products
- TigerGraph Community Edition
- Organizations
- 0day Rubbish
From the original article
Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in TigerGraph Community Edition 4. 2. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.