1
2name: crowdsecurity/vpatch-CVE-2024-27348
3description: "Apache HugeGraph-Server - RCE (CVE-2024-27348)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: POST
11    - zones:
12      - URI
13      transform:
14      - lowercase
15      match:
16        type: endsWith
17        value: /gremlin
18    - zones:
19      - BODY_ARGS
20      variables:
21      - json.gremlin
22      transform:
23      - lowercase
24      match:
25        type: contains
26        value: "java.lang.processbuilder"
27labels:
28  type: exploit
29  service: http
30  confidence: 3
31  spoofable: 0
32  behavior: "http:exploit"
33  label: "Apache HugeGraph-Server - RCE"
34  classification:
35   - cve.CVE-2024-27348
36   - attack.T1595
37   - attack.T1190
38   - cwe.CWE-77