Vulnerability · Published Sep 21, 2024 · Assigned by apache

CVE-2024-42323Apache HertzBeat: RCE by snakeYaml deser load malicious xml

High 8.8

In plain English

A high-severity unsafe deserialization in Apache HertzBeat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)8.3%top 5.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache HertzBeat	0 – before 1.6.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t vendor-advisory
https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx vendor-advisory
http://www.openwall.com/lists/oss-security/2024/09/21/1