Apache HugeGraph-Server: Remote Code Execution via Gremlin Query Injection (CVE-2024-27348)

CVE-2024-27348 is a critical Remote Code Execution vulnerability in Apache HugeGraph-Server. An attacker can submit a malicious Gremlin query to the /gremlin endpoint, leveraging Java reflection to achieve arbitrary code execution on the underlying host. Proof-of-concept toolkits are publicly available that demonstrate deploying a PHP web shell to /tmp/shell.php and initiating a PHP development server on port 4444 to provide persistent command-line access.

Attack Chain

1. Reconnaissance: Identify target Apache HugeGraph-Server instance (typically port 8182).
2. Initial Access: Send a crafted Gremlin query containing malicious Java reflection payloads to the /gremlin endpoint.
3. Execution: Leverage Java reflection to execute system commands on the server.
4. Persistence/Payload Deployment: Write a PHP web shell to the local filesystem (e.g., /tmp/shell.php).
5. Payload Activation: Start a PHP development server on an arbitrary port (e.g., 4444) to host the web shell.
6. Command and Control: Connect via a remote bind shell client to the hosted web shell for interactive command execution.

Recommendation

• Upgrade Apache HugeGraph-Server to version 3.7.2 or later immediately.
• Inspect the /tmp directory and web-accessible application directories for unauthorized PHP files or unexpected script execution.
• Monitor network traffic for unexpected connections originating from the HugeGraph server, specifically looking for outbound connections to port 4444 or abnormal traffic patterns on the Gremlin API port.
• Audit logs for the /gremlin endpoint to identify suspicious or highly anomalous query strings.