Threat actors are actively exploiting a recently disclosed critical security flaw impacting Apache HugeGraph-Server that could lead to remote code execution attacks.
Tracked as CVE-2024-27348 (CVSS score: 9.8), the vulnerability impacts all versions of the software before 1.3.0. It has been described as a remote command execution flaw in the Gremlin graph traversal language API.
“Users are recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system, which fixes the issue,” the Apache Software Foundation noted in late April 2024. “Also you could enable the ‘Whitelist-IP/port’ function to improve the security of RESTful-API execution.”
Additional technical specifics about the flaw were released by penetration testing company SecureLayer7 in early June, stating it enables an attacker to bypass sandbox restrictions and achieve code execution, giving them complete control over a susceptible server.
This week, the Shadowserver Foundation said it spotted in-the-wild exploitation attempts that leverage the flaw, making it imperative that users move quickly to apply the latest fixes.
“We are observing Apache HugeGraph-Server CVE-2024-27348 RCE ‘POST /gremlin’ exploitation attempts from multiple sources,” it said. “[Proof-of-concept] code is public since early June. If you run HugeGraph, make sure to update.”
Vulnerabilities discovered in Apache projects have been lucrative attack vectors for the nation-state and financially motivated threat actors in recent years, with flaws in Log4j, ActiveMQ, and RocketMQ coming under heavy exploitation to infiltrate target environments.
