HugeGraph Exploitation Skill
Apache HugeGraph is an open-source graph database engine that provides Gremlin/REST APIs for graph queries.
This skill documents the exploitation methods for two types of high-severity vulnerabilities.
Target Information
- Product：Apache HugeGraph-Server | Default Port：8080
- Fingerprint Identification: Page title contains
HugeGraph, API path /graphs、/gremlin
- FOFA Query：
title="HugeGraph"
- Tech Stack：Java、Gremlin Groovy、Jetty、JanusGraph
Vulnerability Overview
| CVE |
Type |
Authentication Requirement |
Impact |
Severity Level |
Affected Versions |
| CVE-2024-27348 |
Gremlin RCE |
No authentication required |
Remote Code Execution |
Critical |
< 1.3.1 |
| CVE-2024-43441 |
Authentication Bypass |
Bypass authentication |
Unauthorized API access |
Critical |
< 1.5.0 |
Attack Path Decision Tree
目标: TARGET:8080
|
+-- GET /graphs 返回什么?
| +-- 200 (无认证) -> 直接测试 CVE-2024-27348 RCE
| +-- 401 (需认证) -> 测试 CVE-2024-43441 认证绕过
| | +-- 绕过成功 -> 组合利用: 绕过 + RCE
| | +-- 绕过失败 -> 可能已修补认证
| +-- 其他 -> 非 HugeGraph 或异常
|
+-- POST /gremlin 可达?
+-- 是 + 无沙箱 -> CVE-2024-27348 RCE
+-- 否 -> 检查是否有代理/WAF 拦截
Quick Reference Table
| Priority |
CVE |
Detection Method |
One-Sentence Assessment |
| P0 |
CVE-2024-27348 |
POST /gremlin + reflective ProcessBuilder |
"code":200 and no Failed to do request = RCE |
| P0 |
CVE-2024-43441 |
GET /graphs + bypass Bearer Token |
Unauthenticated 401 -> with token returns 200 = bypass |
Notes
- CVE-2024-27348 payload 1 has no command echo and requires OOB (out-of-band) means to obtain output
- For complex commands, use
Arrays.asList("bash", "-c", "CMD") wrapper
- The JWT token expiration time for CVE-2024-43441 is 2035 (
exp: 2071476830), valid long-term
- The two vulnerabilities can be combined for exploitation: first bypass authentication, then achieve RCE via Gremlin
/gremlin endpoints may exist even without authentication; detect first, then exploit
Detailed Reference
