CVE-2024-27348
Apache HugeGraph-Server Improper Access Control Vulnerability
Description
CVE-2024-27348 is a critical remote command execution (RCE) vulnerability in Apache HugeGraph-Server, affecting versions from 1.0.0 up to but not including 1.3.0 when running on Java 8 or Java 11. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the server via network access. With a CVSS score of 9.8 (Critical) and an EPSS probability of 94.34% (100th percentile), it represents the highest possible exploitation risk. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 9, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | hugegraph | >= 1.0.0, < 1.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2024/04/22/3(Mailing List, Third Party Advisory)
- https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication(Product)
- https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9(Mailing List, Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348(Third Party Advisory, US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-27348 by NVD. The vulnerability is a remote command execution flaw in Apache HugeGraph-Server that arises from insufficient access controls on internal API endpoints. HugeGraph-Server exposes RESTful APIs for graph database operations, and certain endpoints allow the execution of Gremlin graph traversal queries or internal management commands without proper authentication or authorization. Attackers can abuse these endpoints to execute arbitrary system commands on the underlying server. The root cause is the combination of an overly permissive API surface and the absence of mandatory authentication, allowing any network-accessible client to submit commands that are executed with the privileges of the HugeGraph-Server process.
Impact Analysis
The impact of CVE-2024-27348 is catastrophic across all security dimensions. Confidentiality is completely compromised, allowing attackers to access all data stored in the HugeGraph database, configuration files containing database credentials and API keys, and any files accessible to the server process. Graph databases often store highly sensitive relationship data, making this particularly damaging for organizations using HugeGraph for knowledge graphs, fraud detection, or identity management. Integrity is fully affected, as attackers can modify graph data, inject false relationships, alter configuration, and plant persistent backdoors on the server. Availability faces total risk since attackers can destroy graph data, crash the service, or deploy resource-consuming payloads.
The vulnerability requires no authentication and no user interaction, with the EPSS score of 94.34% at the 100th percentile — the absolute highest exploitation probability. A public exploit is available through Vicarius vSociety, providing detailed exploitation guidance. While the KEV entry lists ransomware association as "Unknown," the unrestricted remote code execution capability makes any exposed instance an immediate target for cryptomining, data theft, and ransomware operators.
Exploit Maturity
CVE-2024-27348 has reached maximum exploit maturity with confirmed active exploitation in the wild. CISA's inclusion in the KEV catalog with a deadline of October 9, 2024, confirms real-world attacks. The EPSS score of 94.34% at the 100th percentile represents the highest possible exploitation probability, meaning this vulnerability is being more actively exploited than virtually every other tracked CVE. A public exploit and detailed analysis is available at Vicarius vSociety, lowering the exploitation barrier significantly. The vulnerability was also disclosed on the oss-security mailing list, increasing visibility among both defenders and attackers. The ransomware association is listed as "Unknown" in the KEV catalog, but the ease of exploitation and full system access make it an ideal entry point for any threat actor.
Remediation
-
Upgrade to Apache HugeGraph-Server version 1.3.0 or later immediately. The Apache project recommends running version 1.3.0 with Java 11, which includes the security fix. Download the latest release from the official Apache HugeGraph project and follow the upgrade documentation.
-
Enable the authentication system in HugeGraph-Server by configuring user authentication as described in the official documentation. The authentication system is not enabled by default, and enabling it is critical to preventing unauthorized access to the API.
-
Restrict network access to the HugeGraph-Server API by placing it behind a firewall or reverse proxy. The server should never be directly exposed to the internet. Limit access to only trusted internal hosts and applications that require graph database connectivity.
-
Migrate from Java 8 to Java 11 if not already done. The vulnerability specifically affects Java 8 and Java 11 runtimes, and the fix in version 1.3.0 is designed for Java 11. Running on Java 11 with the latest security patches provides additional runtime protections.
-
Audit existing HugeGraph instances for compromise by reviewing server logs for unusual API requests, checking for unauthorized files or processes, and examining network connections for suspicious outbound traffic. Reset all credentials stored in HugeGraph configuration files if any exposure is suspected.
Technical Details
CVE-2024-27348 has a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector breakdown shows maximum exploitability: Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means no special conditions are required. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms the attack is fully automated. Scope (S:U) means the impact is contained to the HugeGraph-Server context. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) are all rated High, indicating total system compromise.
The attack mechanism exploits exposed API endpoints in Apache HugeGraph-Server that accept and execute Gremlin traversal queries or management commands. Gremlin is the graph traversal language used by Apache TinkerPop-compatible graph databases, and HugeGraph-Server processes these queries through its REST API. When the authentication system is not enabled (the default configuration), any client can submit arbitrary Gremlin queries, including those that invoke Java runtime methods to execute system commands. The attacker sends a crafted HTTP request containing a Gremlin query that calls Java's Runtime.getRuntime().exec() or similar methods, achieving arbitrary command execution with the privileges of the HugeGraph-Server process. The vulnerability specifically affects versions 1.0.0 through 1.2.x running on Java 8 and Java 11.
Frequently Asked Questions
What is CVE-2024-27348?
CVE-2024-27348 is a critical remote command execution vulnerability in Apache HugeGraph-Server versions 1.0.0 through 1.2.x. It allows unauthenticated attackers to execute arbitrary system commands through exposed API endpoints, achieving complete server compromise without any credentials.
What versions of Apache HugeGraph-Server are affected?
All versions from 1.0.0 up to (but not including) 1.3.0 are affected when running on Java 8 or Java 11. Users must upgrade to version 1.3.0 or later and enable the authentication system to be protected.
Is my HugeGraph-Server vulnerable if it is not exposed to the internet?
While internet exposure dramatically increases risk, internal-only instances are still vulnerable to attacks from compromised internal hosts or through lateral movement by attackers who have gained initial access to the network. Upgrading and enabling authentication is recommended regardless of network exposure.
Why is enabling authentication specifically mentioned in the fix?
Apache HugeGraph-Server does not enable authentication by default. Even after upgrading to version 1.3.0, the API endpoints remain accessible without credentials unless authentication is explicitly configured. Enabling the auth system is a required step alongside the version upgrade.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.