Critical severity · published Feb 22, 2024
CVE-2023-51388
HertzBeat AviatorScript Inject RCE
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
hertzbeat · dromara
< 1.4.1 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51388
Patch
https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2
Exploit
https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj
More from hertzbeat
9.8
CVE-2023-51389
HertzBeat SnakeYAML Deser RCE
9.8
CVE-2023-51653
Hertzbeat JMX JNDI RCE
8.8
CVE-2024-42362
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
8.8
CVE-2023-51387
Expression Injection Vulnerability in Hertzbeat
7.5
CVE-2023-51650
Unauthorized access vulnerability on three interfaces