CVE-2024-42323
published 2024-09-21CVE-2024-42323: SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
8.32%
94.5th percentile
SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).
This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.0.
Users are recommended to upgrade to version 1.6.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hertzbeat | < 1.6.0 | 1.6.0 |
| apache_software_foundation | apache_hertzbeat | < 1.6.0 | 1.6.0 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
nuclei·CVSS 8.8
CVE-2024-42323 [HIGH] Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication.
Template:
id: CVE-202
No writeups or analysis indexed.
2024-09-21
Published