CVE-2024-12138: Horilla Horilla RCE Vulnerability

CVE-2024-12138 Overview

CVE-2024-12138 affects Horilla, an open-source human resource management system, in versions up to 1.2.1. The vulnerability stems from insecure deserialization [CWE-20] in several application functions, including request_new, get_employee_shift, create_reimbursement, key_result_current_value_update, create_meetings, and create_skills. Attackers can trigger the flaw remotely over the network with low-privileged authentication. A public proof-of-concept exists on GitHub, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can send crafted serialized payloads to Horilla endpoints, leading to remote code execution on the underlying server.

Affected Products

Horilla HRMS versions up to and including 1.2.1
Deployments exposing the affected request handlers to authenticated users
Self-hosted Horilla instances reachable over the network

Discovery Timeline

2024-12-04 - CVE-2024-12138 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12138

Vulnerability Analysis

Horilla accepts serialized data through multiple endpoints tied to HR workflows such as shift retrieval, reimbursement creation, meeting scheduling, and skills management. The application deserializes attacker-controlled input without validating its type or contents. This behavior aligns with classic Python object deserialization weaknesses, where crafted payloads can invoke arbitrary methods during reconstruction.

A public exploit repository demonstrates a working remote code execution chain against the affected functions. Successful exploitation lets an attacker execute operating system commands under the Horilla application account, exposing employee records and connected infrastructure.

Root Cause

The root cause is improper input validation on serialized objects passed to the vulnerable functions. Horilla trusts the structure and class information embedded in request payloads and reconstructs objects before authorization or business-logic checks constrain their use. The affected handlers do not restrict allowed types or apply a safe deserialization allowlist.

Attack Vector

The attack vector is network-based and requires only a low-privileged authenticated session in Horilla. An attacker submits a crafted payload to one of the vulnerable endpoints, such as the request creation or meeting creation routes. During deserialization, gadget chains within the Python runtime or application dependencies execute attacker code. Refer to the GitHub RCE Proof of Concept and VulDB entry #286858 for technical details on the exploitation path.

Detection Methods for CVE-2024-12138

Indicators of Compromise

Unexpected outbound network connections initiated by the Horilla application process to attacker-controlled hosts
Spawning of shell interpreters such as /bin/sh, bash, or python as child processes of the Horilla web worker
HTTP POST requests to endpoints containing request_new, get_employee_shift, create_reimbursement, key_result_current_value_update, create_meetings, or create_skills with binary or base64-encoded bodies

Detection Strategies

Inspect request bodies to the affected routes for pickle, YAML, or other serialized markers such as the \\x80 pickle protocol byte
Alert on Horilla worker processes creating child processes outside the expected Python interpreter tree
Correlate authenticated Horilla session activity with anomalous file writes under the application directory or /tmp

Monitoring Recommendations

Enable verbose application logging for the vulnerable endpoints and forward logs to a centralized SIEM
Baseline outbound network traffic from the Horilla host and alert on new destinations or high-entropy DNS queries
Track authentication events and flag low-privileged accounts that access administrative or configuration endpoints

How to Mitigate CVE-2024-12138

Immediate Actions Required

Restrict network exposure of Horilla to trusted users through VPN, IP allowlists, or reverse proxy authentication
Disable or firewall the affected endpoints if they are not required for daily operations
Rotate credentials and API keys stored on or accessible from the Horilla host if compromise is suspected
Review recent authentication logs for unexpected low-privileged account activity against the vulnerable routes

Patch Information

At the time of publication, no vendor patch is available. The Horilla maintainers were contacted before public disclosure but did not respond. Monitor the Horilla project for future releases and apply any security updates that address the deserialization handlers.

Workarounds

Place Horilla behind a web application firewall with rules that block serialized payloads on the affected paths
Enforce strict role-based access control so that only trusted HR administrators can reach the vulnerable functions
Run Horilla as an unprivileged user inside a container with read-only filesystem and no outbound internet access
Replace unsafe deserialization in custom deployments with JSON parsing and explicit schema validation

bash

# Example nginx rules to block requests to vulnerable endpoints until a patch is available
location ~* /(request_new|get_employee_shift|create_reimbursement|key_result_current_value_update|create_meetings|create_skills) {
    allow 10.0.0.0/8;
    deny all;
}