Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
CVE-2024-42323
Verified
Description
Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication.
Severity
High
CVSS Score
8.8
Exploit Probability
8%
Affected Product
hertzbeat
Published Date
May 2, 2026
Template Author
chrisjr404
CVE-2024-42323.yaml
8.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2024-42323
CWE ID:
cwe-502
Remediation Steps
Upgrade to Apache HertzBeat 1.6.0 or later. Change the default `admin:hertzbeat` credentials in any deployment that has not already done so.