Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the `/api/monitors/import` and `/api/alert/defines/import` endpoints. An authenticated user can submit a YAML file that constructs an `org.h2.jdbc.JdbcConnection` with a malicious H2 in-memory JDBC URL whose `INIT` block contains a `CREATE ALIAS ... $$ ... $$` Java source snippet, achieving remote code execution inside the HertzBeat JVM. The vulnerability is exploitable in default deployments because the official Docker image and quickstart documentation ship with the well-known default credentials `admin:hertzbeat`, which the template uses for chained authentication. References: https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx https://nvd.nist.gov/vuln/detail/CVE-2024-42323 Remediation: Upgrade to Apache HertzBeat 1.6.0 or later. Change the default `admin:hertzbeat` credentials in any deployment that has not already done so.
Used 20 times · 10 assets checked · domain, subdomain, ipv4