{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/hugegraph/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-27348"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HugeGraph-Server (\u003c= 3.7.1)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","hugegraph","gremlin","apache"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eCVE-2024-27348 is a critical Remote Code Execution vulnerability in Apache HugeGraph-Server. An attacker can submit a malicious Gremlin query to the \u003ccode\u003e/gremlin\u003c/code\u003e endpoint, leveraging Java reflection to achieve arbitrary code execution on the underlying host. Proof-of-concept toolkits are publicly available that demonstrate deploying a PHP web shell to \u003ccode\u003e/tmp/shell.php\u003c/code\u003e and initiating a PHP development server on port 4444 to provide persistent command-line access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReconnaissance: Identify target Apache HugeGraph-Server instance (typically port 8182).\u003c/li\u003e\n\u003cli\u003eInitial Access: Send a crafted Gremlin query containing malicious Java reflection payloads to the \u003ccode\u003e/gremlin\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eExecution: Leverage Java reflection to execute system commands on the server.\u003c/li\u003e\n\u003cli\u003ePersistence/Payload Deployment: Write a PHP web shell to the local filesystem (e.g., \u003ccode\u003e/tmp/shell.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003ePayload Activation: Start a PHP development server on an arbitrary port (e.g., 4444) to host the web shell.\u003c/li\u003e\n\u003cli\u003eCommand and Control: Connect via a remote bind shell client to the hosted web shell for interactive command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache HugeGraph-Server to version 3.7.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eInspect the \u003ccode\u003e/tmp\u003c/code\u003e directory and web-accessible application directories for unauthorized PHP files or unexpected script execution.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unexpected connections originating from the HugeGraph server, specifically looking for outbound connections to port 4444 or abnormal traffic patterns on the Gremlin API port.\u003c/li\u003e\n\u003cli\u003eAudit logs for the \u003ccode\u003e/gremlin\u003c/code\u003e endpoint to identify suspicious or highly anomalous query strings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T07:59:20Z","date_published":"2026-11-01T07:59:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2024-27348-hugegraph/","summary":"CVE-2024-27348 is a critical RCE vulnerability in Apache HugeGraph-Server (\u003c= 3.7.1) that allows attackers to execute arbitrary Java code via the /gremlin endpoint, facilitating the deployment of web shells.","title":"Apache HugeGraph-Server: Remote Code Execution via Gremlin Query Injection (CVE-2024-27348)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2024-27348-hugegraph/"}],"language":"en","title":"CraftedSignal Threat Feed - Hugegraph","version":"https://jsonfeed.org/version/1.1"}