-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a remote code execution in Apache HugeGraph's PD (Placement Driver) component, which uses a Raft consensus algorithm for coordination. The root cause is twofold:
Insecure Deserialization: The org.apache.hugegraph.pd.raft.KVOperation.fromByteArray function uses Hessian to deserialize data for Raft log entries. Before the patch, it did not employ a class whitelist, making it vulnerable to deserialization attacks. An attacker could craft a malicious object that, upon deserialization, would execute arbitrary code on the server.
Missing Authentication: The Raft communication channel, set up by the org.apache.hugegraph.pd.raft.RaftEngine.createRaftRpcServer function, had no authentication. This allowed any unauthorized actor on the network to connect to the Raft cluster as a peer and submit data. This open access provided the entry point for an attacker to send the malicious serialized payload.
The patch addresses both issues. It introduces an IP-based authentication handler (IpAuthHandler) in the Raft RPC server to restrict access to only known peers in the cluster. Secondly, it implements a strict class whitelist (HugegraphHessianSerializerFactory) that is now used during Hessian deserialization in KVOperation.fromByteArray, ensuring only expected and safe classes can be deserialized. During an exploit, the createRaftRpcServer function would be called to establish the insecure connection, and KVOperation.fromByteArray would be the function that triggers the code execution when processing the malicious Raft entry.
org.apache.hugegraph.pd.raft.KVOperation.fromByteArrayhugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/raft/KVOperation.java
org.apache.hugegraph.pd.raft.RaftEngine.createRaftRpcServerhugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/raft/RaftEngine.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hugegraph:hg-pd-core | maven | < 1.7.0 | 1.7.0 |