CVE-2024-27348 PoC — Apache HugeGraph-Server: Command execution in gremlin

Source

Associated Vulnerability

Readme

# Remote Code Execution vulnerability in Apache HugeGraph Server (CVE-2024–27348)

[CVE-2024-27348](https://nvd.nist.gov/vuln/detail/CVE-2024-27348) is a critical Remote Command Execution (RCE) vulnerability in Apache HugeGraph Server, a popular graph database system. The flaw resides in the Gremlin traversal language interface, which allows users to interact with the graph database. An attacker can exploit this vulnerability by sending specially crafted requests to the Gremlin server, potentially gaining the ability to bypass the sandbox and execute arbitrary code on the underlying system.

To mitigate this risk, the Apache Software Foundation recommends users to upgrade to HugeGraph version 1.3.0 or later and ensure it runs on Java 11. Additionally, implementing the built-in authentication system and configuring the "Whitelist-IP/port" function can help restrict access and improve security​.


## Usage
```
python3 exploit.py -t http://<target_host>:<target_port> -c "<cmd>"
```

Detection script:
```
python detect.py --target http://<target_host> --port <target_port> --domain <your_domain>
```

## Disclaimer
This exploit script has been created solely for research and the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The script's author and owner disclaim any responsibility or liability for any misuse or damage caused by this software. Just so you know, users are urged to use this software responsibly and only by applicable laws and regulations. Use responsibly.

File Snapshot

 [4.0K]  /data/pocs/11bc52cb61b040606c40dedb4e89f949020a872a
├── [2.1K]  detect.py
├── [3.0K]  exploit.py
├── [1.0K]  LICENSE
└── [1.5K]  README.md

0 directories, 4 files

Remarks