CVE-2024-27348-Apache-HugeGraph-RCE

Apache HugeGraph Server 원격 코드 실행 취약점 CVE-2024–27348 CVE-2024-27348은 널리 사용되는 그래프 데이터베이스 시스템인 Apache HugeGraph Server의 치명적인 원격 명령 실행RCE 취약점입니다. 이 결함은 사용자가 그래프 데이터베이스와 상호작용할 수 있게 해주는 Gremlin traversal 언어 인터페이스에 존재합니다. 공격자는 특수하게 조작된 요청을 Gremlin 서버에 전송하여 이 취약점을 악용할 수 있으며, 이로 인해 샌드박스를 우회하고 기본 시스템에서 임의...

CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE（高度なサンドボックス回避） CVE-2024-27348 （Apache HugeGraph Server におけるリモートコード実行）のための高度で信頼性の高い Proof of Concept（PoC）エクスプロイトです。 公開されている多くの PoC はコマンドを盲目的に実行したり、Java の Runtime.exec の制限により複雑なペイロードで失敗したりしますが、本スクリプトは実際のペネトレーションテストシナリオにおける信頼性 を考慮して設計されています。 ⚠️ 免責事項...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 概念验证利用——Apache HugeGraph Server 中的 RCE 未认证用户可通过 Groovy 注入在 Apache HugeGraph Server 上执行操作系统命令。 使用 🛠 攻击多个目标 ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" 攻击单个目标 🗡 python3 CVE-2024-27348.py -t http://target.tld:8080 -c "command to execute" 参数 🧰 参数...

CVE-2024-27348

CVE-2024-27348 倫理的な使用のみを目的としています。有害または悪意のある活動は許可されていません。また、それはあなた自身の責任です。 脆弱性の分析はこちらからお読みいただけます: https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/ Apache HugeGraph Server RCE...

CVE-2024-27348

CVE-2024-27348 Apache HugeGraph のリモートコード実行脆弱性 CVE-2024-27348 に関するリポジトリです。 Docker docker pull hugegraph/hugegraph:1.0.0 docker run -it --name hgserver -p 8081:8080 hugegraph/hugegraph:1.0.0 docker-compose.yml services: web: image: vulhub/hugegraph:1.2.0 ports: - "8080:8080" - "5005:5005" docker...

Apache HugeGraph-Server <1.5.0 - Authentication Bypass

Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction. id: CVE-2024-43441 info: name: Apache...

Apache HugeGraph-Server - Remote Command Execution

Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution RC...

Exploit for Improper Access Control in Apache Hugegraph

CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass...

Apache HugeGraph-Server Deserialization Vulnerability

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...

Remote Code Execution (RCE)

org.apache.hugegraph, hg-pd-core is vulnerable to a Remote Code Execution. The vulnerability is due to insecure Hessian deserialization in the Raft cluster membership logic, where a malicious Raft node can send crafted objects that bypass type safety and trigger unsafe deserialization and attacke...

Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via insecure Hessian deserialization in the PD store. An attacker can execute arbitrary code by sending maliciously crafted data from a compromised or rogue Raft node. Details Serialization is a process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866

Apache HugeGraph-Server is vulnerable to remote code execution (RCE) due to insecure Hessian deserialization within the PD store . An attacker can exploit this by using a malicious Raft node to perform object injection attacks . To remediate this vulnerability, users are recommended to upgrade to...

Apache HugeGraph-Server 安全漏洞

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...

PT-2025-50223

Name of the Vulnerable Software and Affected Versions Apache HugeGraph-Server versions prior to 1.7.0 Description A remote code execution issue exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict...

EUVD-2024-1128

Malicious code in bioql PyPI...

EUVD-2024-1138

Malicious code in bioql PyPI...

CVE-2024-43441

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue...