GHSA-29rc-vq7f-x335 CVE-2024-27348
Apache HugeGraph-Server: Command execution in gremlin
Critical
Known exploited
Maven
- Severity
- 9.3 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 99.21%
- Chance of exploitation in the next 30 days. Higher than 99.94% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 18, 2024
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-284 Improper Access Control
- Fix
- Available
- 2 packages have a fixed version
Exploited in the wild. Apache HugeGraph-Server Improper Access Control Vulnerability (Apache HugeGraph-Server). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Oct 9, 2024.
Description
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.hugegraph:hugegraph-api | >= 1.0.0, < 1.3.0 |
1.3.0 |
| org.apache.hugegraph:hugegraph-api | >= 1.0.0, < 1.3.0 |
1.3.0 |
| org.apache.hugegraph:hugegraph-core | >= 1.0.0, < 1.3.0 |
1.3.0 |
| org.apache.hugegraph:hugegraph-core | >= 1.0.0, < 1.3.0 |
1.3.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.hugegraph:hugegraph-api Maven → 1.3.0
- maven
<dependency><groupId>org.apache.hugegraph</groupId><artifactId>hugegraph-api</artifactId><version>1.3.0</version></dependency>- gradle
implementation("org.apache.hugegraph:hugegraph-api:1.3.0")
org.apache.hugegraph:hugegraph-core Maven → 1.3.0
- maven
<dependency><groupId>org.apache.hugegraph</groupId><artifactId>hugegraph-core</artifactId><version>1.3.0</version></dependency>- gradle
implementation("org.apache.hugegraph:hugegraph-core:1.3.0")
Severity breakdown
CVSS 4.0 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Attacked
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Exploit maturity
- H
Weakness
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
How to prevent it
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | High | Same weakness, CWE-77 |
| CVE-2026-96951 Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security… | High Known exploited | Same weakness, CWE-77 |
| CVE-2026-105134 A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. | Critical Known exploited | Same weakness, CWE-77 |
| GHSA-jf24-8g2h-2wg7 LibreNMS Vulnerable to Remote Code Execution via AboutController | High | Same weakness, CWE-77 |
| GHSA-c9fv-cgmm-2wg7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module | High | Same weakness, CWE-77 |
| GHSA-6qc3-v8fv-fv9j Apache Ranger has a Command Injection vulnerability | Critical | Same weakness, CWE-77 |
| GHSA-956x-8gvw-wg5v GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()` | High | Same weakness, CWE-77 |
| GHSA-qf6p-p7ww-cwr9 Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge | Critical | Same weakness, CWE-77 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor