actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-facing-service-vulnerabilityproof-of-concept-release

Active Exploitation of Apache HugeGraph RCE Targets More Than 2,000 Devices

Active Exploitation · 2 sources · Updated 1mo ago · First seen Sep 18, 2024

Attackers are actively exploiting CVE-2024-27348, an improper access control vulnerability in Apache HugeGraph-Server that allows unauthenticated execution of arbitrary operating system commands through Gremlin. Apache disclosed the command-execution flaw in an April 22, 2024 advisory. FortiGuard Labs subsequently reported intensified exploitation during its September reporting week, with sensors blocking attempts against more than 2,000 devices; that figure represents targeted devices, not confirmed compromises.

Public proof-of-concept exploit code is available, and CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on September 18, 2024. Successful exploitation could enable unauthorized access, data manipulation, and complete system compromise. Apache HugeGraph-Server version 1.3.0 patches the vulnerability. Organizations running affected deployments should prioritize upgrading according to Apache’s advisory and review exposed servers for evidence of exploitation.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Sep 18, 2024

Reported Sep 25, 20242y ago
FortiGuard reports intensified exploitation attempts against over 2,000 devices
FortiGuard reports that attempts to exploit CVE-2024-27348 appeared to intensify during the reporting week. Its sensors blocked attacks targeting the vulnerability on more than 2,000 devices.
Threat Signal Report | FortiGuard Labs
Reported Sep 25, 20242y ago
Proof-of-concept exploit code becomes publicly available
Public proof-of-concept exploit code for CVE-2024-27348 becomes available, demonstrating exploitation of the HugeGraph-Server vulnerability.
Threat Signal Report | FortiGuard Labs
Reported Sep 25, 20242y ago
Apache HugeGraph-Server 1.3.0 provides a fix for CVE-2024-27348
Apache HugeGraph-Server version 1.3.0 patches CVE-2024-27348. FortiGuard advises users to upgrade and follow the vendor advisory's instructions.
Threat Signal Report | FortiGuard Labs
Sep 18, 20242y ago
CISA adds CVE-2024-27348 to its Known Exploited Vulnerabilities Catalog
CISA adds the Apache HugeGraph-Server vulnerability CVE-2024-27348 to its Known Exploited Vulnerabilities Catalog.
Threat Signal Report | FortiGuard Labs
Reported Apr 22, 20243y ago
Apache discloses HugeGraph-Server command execution vulnerability
Apache's advisory identifies CVE-2024-27348 as a command execution vulnerability in Gremlin affecting HugeGraph-Server. The improper access control flaw allows unauthenticated attackers to execute arbitrary operating system commands.
CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Gremlin Filter Bypass RCE in Apache HugeGraph-Server (CVE-2024-27348)

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Fortinet Threat SignalNews · Sep 25, 2024

Threat Signal Report | FortiGuard LabsOpen source ↗

Lists ApacheNews · Apr 22, 2024

CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlinOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Active Exploitation of Apache HugeGraph RCE Targets More Than 2,000 Devices

How this story unfolded

FortiGuard reports intensified exploitation attempts against over 2,000 devices

Proof-of-concept exploit code becomes publicly available

Apache HugeGraph-Server 1.3.0 provides a fix for CVE-2024-27348

CISA adds CVE-2024-27348 to its Known Exploited Vulnerabilities Catalog

Apache discloses HugeGraph-Server command execution vulnerability

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache HTTP Server Flaws Fuel Millions of Exploit Detections

Active Exploitation of Critical Infrastructure Management RCE Flaws

Critical Confluence RCE Exploited to Deploy Cryptominers, Sliver Implants and Godzilla Backdoors

Active Exploitation of Apache HugeGraph RCE Targets More Than 2,000 Devices

How this story unfolded

FortiGuard reports intensified exploitation attempts against over 2,000 devices

Proof-of-concept exploit code becomes publicly available

Apache HugeGraph-Server 1.3.0 provides a fix for CVE-2024-27348

CISA adds CVE-2024-27348 to its Known Exploited Vulnerabilities Catalog

Apache discloses HugeGraph-Server command execution vulnerability

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache HTTP Server Flaws Fuel Millions of Exploit Detections

Active Exploitation of Critical Infrastructure Management RCE Flaws

Critical Confluence RCE Exploited to Deploy Cryptominers, Sliver Implants and Godzilla Backdoors