CVE-2024-42361: GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
First published: Tue Aug 20 2024(Updated: )
Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dromara Hertzbeat | <1.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/
- https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/manager/src/main/java/org/dromara/hertzbeat/manager/controller/MonitorsController.java#L202
- https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L242
- https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L295
Frequently Asked Questions
What is the severity of CVE-2024-42361?
CVE-2024-42361 is considered a critical vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2024-42361?
To fix CVE-2024-42361, upgrade Hertzbeat to version 1.6.1 or later where the SQL injection vulnerability is addressed.
What impact does CVE-2024-42361 have on my system?
CVE-2024-42361 allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.
Which versions of Hertzbeat are affected by CVE-2024-42361?
CVE-2024-42361 affects Hertzbeat versions 1.6.0 and earlier.
Can CVE-2024-42361 be exploited remotely?
Yes, CVE-2024-42361 can be exploited remotely through the vulnerable API endpoint.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/dromara hertzbeat