CVE-2024-27348
About
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
Rainforest analyst review
This is a remote command execution flaw in Apache HugeGraph-Server affecting 1.0.0 through versions before 1.3.0 on Java 8 and Java 11. The root cause is inadequate access control around functionality that can reach the underlying runtime, allowing an attacker to bypass the intended restrictions and execute commands on the server. Where the deployment does not enforce authentication, the exposed API is enough for an attacker to reach the vulnerable path and run code.
HugeGraph is an open-source graph database, and instances are often stood up on internal or cloud infrastructure with the server's API reachable and the built-in Auth system left disabled, which is exactly the condition that makes this exploitable. Public exploitation was reported after disclosure, so an exposed server should be treated as at risk. The fix is to upgrade to version 1.3.0 running on Java 11 and to enable the Auth system, since the patch depends on both; simply updating the JAR without turning on authentication and using the correct runtime leaves the door open. Restrict network access to the server's API to trusted clients and review the host for signs of command execution.
References
- http://www.openwall.com/lists/oss-security/2024/04/22/3
- https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication
- https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9
- https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348
Related CVEs
Frequently asked questions
What is CVE-2024-27348?
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
How severe is CVE-2024-27348?
CVE-2024-27348 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2024-27348 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2024-27348?
Public advisories list the following as affected: hugegraph. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-27348?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.