CISA warns of actively exploited Apache HugeGraph-Server bug

The U.S. Cybersecurity and Infrastructure Agency (CISA) has added five flaws to its Known Exploited Vulnerabilities (KEV) catalog, among which is a remote code execution (RCE) flaw impacting Apache HugeGraph-Server.

The flaw, tracked as CVE-2024-27348 and rated critical (CVSS v3.1 score: 9.8), is an improper access control vulnerability that impacts HugeGraph-Server versions from 1.0.0 and up to, but not including 1.3.0.

Apache fixed the vulnerability on April 22, 2024, with the release of version 1.3.0. Apart from upgrading to the latest version, users were also recommended to use Java 11 and enable the Auth system.

Also, enabling the "Whitelist-IP/port" function was proposed to improve the security of the RESTful-API execution, which was involved in potential attack chains.

Now, CISA has warned that active exploitation of CVE-2024-27348 has been observed in the wild, giving federal agencies and other critical infrastructure organizations until October 9, 2024, to apply mitigations or discontinue the use of the product.

Apache HugeGraph-Server is the core component of the Apache HugeGraph project, an open-source graph database designed for handling large-scale graph data with high performance and scalability, supporting complex operations required in deep relationship exploitation, data clustering, and path searches.

The product is used, among others, by telecom providers for fraud detection and network analysis, financial services for risk control and transaction pattern analysis, and social networks for connection analysis and automated recommendation systems.

With active exploitation underway and the product used in apparently high-value enterprise environments, applying the available security updates and mitigations as soon as possible is exigent.

The other four flaws added to KEV this time are:

CVE-2020-0618: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability CVE-2019-1069: Microsoft Windows Task Scheduler Privilege Escalation Vulnerability CVE-2022-21445: Oracle JDeveloper Remote Code Execution Vulnerability CVE-2020-14644: Oracle WebLogic Server Remote Code Execution Vulnerability

The inclusion of these older vulnerabilities is not an indication of recent exploitation but serves to enrich the KEV catalog by documenting security flaws that were confirmed to have been used in attacks at some point in the past.