RCE in Apache Hertzbeat
CVE-2023-51387
Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.015 (70.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Hertzbeat
- Dromara Hertzbeat — versions < 1.4.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-51387?
- CVE-2023-51387 is a high-severity vulnerability in Apache Hertzbeat, classified under Code Injection. CVSS score: 7.2/10. Published 2023-12-22.
- How severe is CVE-2023-51387?
- High severity. CVSS v3 base score is 7.2 out of 10.