# CVE-2024-27348: Apache HugeGraph-Server - RCE

> Live exploitation tracking for CVE-2024-27348 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-27348

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Apache HugeGraph-Server
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

## Description

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

## CrowdSec analysis

[CVE-2024-27348](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-27348) is a remote code execution vulnerability in Apache HugeGraph-Server, allowing attackers to execute arbitrary commands on vulnerable systems via exposed endpoints.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of August 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-27348 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-27348 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts usually target URLs containing `/gremlin`, aiming to compromise misconfigured or unsecured instances.

## Timeline

- 2024-04-22: CVE Published. CVE-2024-27348 is published to NVD.
- 2024-08-22: Rule Released. CrowdSec releases a rule to detect CVE-2024-27348 exploitation attempts against the CrowdSec Network.
- 2024-09-18: CISA KEV. CVE-2024-27348 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-10-09: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-27348 for the first time.

## References

- https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication
- https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27348.yaml
- https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-27348) follows observed exploitation activity for CVE-2024-27348. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.