Metasploit Weekly Wrap-Up 08/16/2024

New module content 3 Apache HugeGraph Gremlin RCE Authors: 6right and jheysel-r7 Type: Exploit Pull request: 19348 contributed by jheysel-r7 Path: linux/http/apachehugegraphgremlinrce AttackerKB reference: CVE-2024-27348 Description: Adds an Apache HugeGraph Server exploit for GHSA-29rc-vq7f-x335...

Apache HugeGraph Gremlin Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache HugeGraph Gremlin RCE', 'Description' = %q This module exploits CVE-2024-27348 which is a Remote Code Execution RCE vulnerability that...

Apache HugeGraph Gremlin Remote Code Execution Exploit

This Metasploit module exploits CVE-2024-27348, a remote code execution vulnerability that exists in Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve remote code execution through Gremlin, resulting in complete control over the server...

Apache HugeGraph Gremlin RCE

This module exploits CVE-2024-27348 which is a Remote Code Execution RCE vulnerability that exists in Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve RCE through Gremlin, resulting in complete control over the server Module Options msf...

PT-2024-10202 · Apache · Apache Hugegraph-Server

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.5.0 Description: The issue is related to an authentication bypass vulnerability in Apache HugeGraph-Server, which can be exploited by remote attackers to execute arbitrary code. This...

Apache Hugegraph 1.0.0 < 1.3.0 Remote Command Execution

Apache Hugegraph versions 1.0.0 prior to 1.3.0 is affected by a vulnerability allowing an unauthenticated attacker to execute remote commands via a specially forged request. No source data...

Critical Apache HugeGraph Vulnerability Under Attack - Patch ASAP

Threat actors are actively exploiting a recently disclosed critical security flaw impacting Apache HugeGraph-Server that could lead to remote code execution attacks. Tracked as CVE-2024-27348 CVSS score: 9.8, the vulnerability impacts all versions of the software before 1.3.0. It has been describ...

VulnCheck KEV: CVE-2024-27348

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code...

The Bug Report - June 2024 Edition

The Bug Report - June 2024 Edition By Jonathan Omakun & Tobi Olawale · June 27, 2024 Why am I Here Welcome back to The Bug Report, the "so hot the server fans are sweating" edition! For those who are new to our monthly adventure, every month, our dedicated Advanced Research Center vulnerability...

Exploit for Improper Access Control in Apache Hugegraph

Remote Code Execution vulnerability in Apache HugeGraph Server...

POC Exploit Code Released for Apache HugeGraph RCE Vulnerability

...

The vulnerability of the Apache HugeGraph graph database server, related to the ability to bypass the authentication process, allows attackers to execute arbitrary code.

The vulnerability of the Apache HugeGraph graph database server relates to the bypassing of the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

Exploit for Improper Access Control in Apache Hugegraph

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE...

Exploit for Improper Access Control in Apache Hugegraph

CVE-2024-27348 For Ethical Usages only, Any harmful or malic...

Apache HugeGraph-Hubble Server-Side Request Forgery Vulnerability

Apache HugeGraph is a fast and scalable graph database from the Apache USA Foundation. Apache HugeGraph-Hubble suffers from a server-side request forgery vulnerability that can be exploited by an attacker to conduct SSRF attacks through the use of specially crafted parameters...

Apache HugeGraph-Server Command Execution Vulnerability

Apache HugeGraph is a fast and scalable graph database from the Apache USA Foundation. A command execution vulnerability exists in Apache HugeGraph-Server, which can be exploited by an attacker to execute arbitrary commands on a system...

Apache HugeGraph-Server Security Bypass Vulnerability

Apache HugeGraph-Server is the United States Apache Apache Foundation of a fast, scalable graph database. A security bypass vulnerability exists in Apache HugeGraph-Server, which can be exploited by an attacker to bypass whitelisting by sending specially crafted requests in authentication mode...

Authentication Bypass Via Spoofing

Apache HugeGraph-api is vulnerable to an Authentication Bypass via Spoofing. The vulnerability is due to insufficient authentication checks, allowing an attacker to bypass authentication by spoofing certain parameters or headers...

Server-Side Request Forgery (SSRF)

Apache HugeGraph-Hubble is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is caused due to inadequate improper input validation, which allows attackers to send crafted requests to internal or restricted network resources...

org.apache.hugegraph:hugegraph-api (>=1.0.0 <=1.2.0), org.apache.hugegraph:hugegraph-cassandra (>=1.0.0 <=1.2.0) +9 more potentially affected by CVE-2024-27348 via org.apache.hugegraph:hugegraph-core (>=1.0.0 <=1.2.0)

org.apache.hugegraph:hugegraph-core MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2024-27348 Source advisory: OSV:GHSA-29RC-VQ7F-X335...