CVE-2024-27348 PoC — Apache HugeGraph-Server: Command execution in gremlin

Source

Associated Vulnerability

Description

This is a repository for Apache HugeGraph Remote Code Execution vulnerability(CVE-2024-27348))

Readme

# CVE-2024-27348
This is a repository for Apache HugeGraph Remote Code Execution vulnerability(CVE-2024-27348))
# Docker
```
docker pull hugegraph/hugegraph:1.0.0
docker run -it --name hgserver -p 8081:8080 hugegraph/hugegraph:1.0.0

```
# docker-compose.yml
```
services:
  web:
    image: vulhub/hugegraph:1.2.0
    ports:
      - "8080:8080"
      - "5005:5005"
```
```
### docker compose up -d   
### visit：http://your_ip:8080 
```
# exploit
```
python .\CVE-2024-27348.py -t http://192.168.41.163:8080 -c "id"
```
![picture](./picture.png)
# about
For all you can see it
```
https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348
```

File Snapshot

 [4.0K]  /data/pocs/254513426646cbd7ef39066310aa5bd179e1d524
├── [3.5K]  CVE-2024-27348.py
├── [ 42K]  picture.png
└── [ 703]  README.md

0 directories, 3 files

Remarks