Apache HugeGraph-Server flaw actively exploited, CISA warns

News
By
published

The vulnerability has been patched months ago

An abstract image of a lock against a digital background, denoting cybersecurity.
(Image Credit: TheDigitalArtist / Pixabay) (Image credit: Pixabay)

The US Cybersecurity and Infrastructure Security Agency (CISA) has added an Apache HugeGraph-Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling that the bug is actively being exploited in the wild.

The addition also forces federal agencies to apply a patch before the October 9 deadline, or stop using the vulnerable product altogether.

The bug in question is a remote command execution flaw in the Gremlin graph traversal language API. It carries a severity score of 9.8, and affects all versions of the software prior to 1.3.0. It is tracked as CVE-2024-27348, and it was patched months ago - in April.

Four more bugs

Besides installing the patch, users are also recommended to use JAva 11 and enable the Auth system. Furthermore, they should enable the “Whitelist-IP/port” function, since it improves the security of the RESTful-API execution, it was added.

In mid-July this year, the Shadowserver Foundation said it found evidence of the flaw’s exploitation, adding that the PoC code has been public since early June.

“If you run HugeGraph, make sure to update,” the organization said at the time.

Apache HugeGraph is an open source graph database system, supporting the storage and querying of billions of vertices and edges. Implemented with the Apache TinkerPop3 framework, it is fully compatible with the Gremlin query language, allowing for complex graph queries and analyses.

Besides the RCE flaw, CISA added another four flaws to the KEV catalog - a Microsoft SQL Server Reporting Services Remote Code Execution vulnerability (CVE-2020-0618), a Microsoft Windows Task Scheduler Privilege Escalation vulnerability (CVE-2019-1069), an Oracle JDeveloper Remote Code Execution vulnerability (CVE-2022-21445), and an Oracle WebLogic Server Remote Code Execution vulnerability (CVE-2020-14644).

Adding these bugs to the catalog doesn’t necessarily mean they are currently being exploited, BleepingComputer reports, it just means that they were being exploited at some point in the past.

Via BleepingComputer

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.