CVE-2024-27348 PoC — Apache HugeGraph-Server: Command execution in gremlin

Source

https://github.com/kljunowsky/CVE-2024-27348

Associated Vulnerability

Title: Apache HugeGraph-Server: Command execution in gremlin (CVE-2024-27348)
Description:RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Description

Apache HugeGraph Server Unauthenticated RCE - CVE-2024-27348 Proof of concept Exploit

Readme

# CVE-2024-27348 🪶

CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server

Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. 


## Usage 🛠 

Exploit multiple targets ☣️
```
python3 CVE-2024-27348.py -f targets.txt -c "command to execute"
```

Exploit single target 🗡
```
python3 CVE-2024-27348.py -t http://target.tld:8080 -c "command to execute"
```

## Parameters 🧰 

Parameter | Description | Type
------------ | ------------- | -------------
-c/--comand |  Command to execute on target | String
-t/--target | URL, Single target  | String
-f/--file | Multiple targets | File


## Contact Me📇

[Twitter - Milan Jovic](https://twitter.com/milanshiftsec)

[LinkedIn - Milan Jovic](https://www.linkedin.com/in/milan-jovic-sec/)

#### Educational purposes only and cannot be used for law violation or personal gain.
#### The author of this project is not responsible for any possible harm caused by the materials of this project.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →