HugeGraph-Server (<= 3.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hugegraph-server--3.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 07:59:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache HugeGraph-Server: Remote Code Execution via Gremlin Query Injection (CVE-2024-27348)https://feed.craftedsignal.io/briefs/2026-11-cve-2024-27348-hugegraph/Sun, 01 Nov 2026 07:59:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2024-27348-hugegraph/CVE-2024-27348 is a critical RCE vulnerability in Apache HugeGraph-Server (<= 3.7.1) that allows attackers to execute arbitrary Java code via the /gremlin endpoint, facilitating the deployment of web shells.CVE-2024-27348 is a critical Remote Code Execution vulnerability in Apache HugeGraph-Server. An attacker can submit a malicious Gremlin query to the /gremlin endpoint, leveraging Java reflection to achieve arbitrary code execution on the underlying host. Proof-of-concept toolkits are publicly available that demonstrate deploying a PHP web shell to /tmp/shell.php and initiating a PHP development server on port 4444 to provide persistent command-line access.

Attack Chain

  1. Reconnaissance: Identify target Apache HugeGraph-Server instance (typically port 8182).
  2. Initial Access: Send a crafted Gremlin query containing malicious Java reflection payloads to the /gremlin endpoint.
  3. Execution: Leverage Java reflection to execute system commands on the server.
  4. Persistence/Payload Deployment: Write a PHP web shell to the local filesystem (e.g., /tmp/shell.php).
  5. Payload Activation: Start a PHP development server on an arbitrary port (e.g., 4444) to host the web shell.
  6. Command and Control: Connect via a remote bind shell client to the hosted web shell for interactive command execution.

Recommendation

  • Upgrade Apache HugeGraph-Server to version 3.7.2 or later immediately.
  • Inspect the /tmp directory and web-accessible application directories for unauthorized PHP files or unexpected script execution.
  • Monitor network traffic for unexpected connections originating from the HugeGraph server, specifically looking for outbound connections to port 4444 or abnormal traffic patterns on the Gremlin API port.
  • Audit logs for the /gremlin endpoint to identify suspicious or highly anomalous query strings.
]]>criticaladvisoryremote-code-executionhugegraphgremlinapache