CVE-2024-42323: Apache Hertzbeat RCE Vulnerability

CVE-2024-42323 Overview

CVE-2024-42323 is an insecure deserialization vulnerability in Apache HertzBeat (incubating), an open-source real-time monitoring system. The flaw resides in the SnakeYAML library integration, where malicious XML payloads can trigger unsafe deserialization and lead to remote code execution (RCE). Exploitation requires an authenticated attacker with low privileges. All versions of Apache HertzBeat prior to 1.6.0 are affected. The Apache Software Foundation released version 1.6.0 to remediate the issue.

Critical Impact
An authenticated attacker can achieve remote code execution on the HertzBeat server by supplying a crafted YAML/XML payload, compromising confidentiality, integrity, and availability of the monitoring platform.

Affected Products

Apache HertzBeat (incubating) versions before 1.6.0
Deployments using SnakeYAML for configuration parsing
Self-hosted HertzBeat monitoring instances

Discovery Timeline

2024-09-21 - CVE-2024-42323 published to NVD
2024-09-21 - Apache Software Foundation disclosure via oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42323

Vulnerability Analysis

The vulnerability is classified under [CWE-502]: Deserialization of Untrusted Data. Apache HertzBeat uses SnakeYAML to parse configuration content, and the parsing routine invokes an unsafe constructor that permits arbitrary Java class instantiation during deserialization. When a crafted YAML document referencing a malicious XML payload is processed, the SnakeYAML Constructor builds attacker-controlled objects and invokes their methods. This behavior allows an authenticated attacker to trigger remote code execution on the HertzBeat server process.

The attack requires authenticated access with low privileges over the network. No user interaction is needed once the payload reaches the vulnerable endpoint. The scope remains unchanged, but the attacker gains full control of the JVM hosting HertzBeat.

Root Cause

The root cause is the use of SnakeYAML's default Constructor (or equivalent unsafe loader) rather than SafeConstructor when parsing user-controllable YAML input. SnakeYAML's unsafe loader resolves the !! tag syntax to arbitrary Java classes, enabling gadget chains that lead to code execution during object graph construction.

Attack Vector

An authenticated attacker submits a YAML payload through a HertzBeat endpoint that forwards the content to SnakeYAML for deserialization. The payload references Java classes capable of executing commands during instantiation, such as ones that load remote XML configuration and coerce the JVM into invoking attacker-defined methods. Successful exploitation yields command execution under the HertzBeat service account.

Detailed technical discussion is available in the Apache Mailing List Thread and the Open Wall Mailing List Post.

Detection Methods for CVE-2024-42323

Indicators of Compromise

Outbound HTTP requests from the HertzBeat server to unfamiliar hosts fetching XML or class definitions during YAML processing
Child processes spawned by the HertzBeat Java process such as sh, bash, cmd.exe, or powershell.exe
YAML payloads in application logs containing !! tag references to classes like javax.script.ScriptEngineManager or org.springframework gadgets
Unexpected file writes or new listeners on the host running HertzBeat

Detection Strategies

Inspect HertzBeat application logs for SnakeYAML parsing exceptions or stack traces referencing custom class instantiation
Alert on process-lineage anomalies where the HertzBeat JVM spawns shell interpreters or network utilities
Monitor egress traffic from monitoring servers, which typically originate only well-known metric collection connections

Monitoring Recommendations

Enable authentication auditing on HertzBeat and correlate low-privilege user sessions with configuration-change endpoints
Capture command-line arguments and parent-child process telemetry from the HertzBeat host and ship to a central SIEM
Baseline outbound connections from the monitoring server and alert on deviations to non-monitored assets

How to Mitigate CVE-2024-42323

Immediate Actions Required

Upgrade Apache HertzBeat to version 1.6.0 or later, which replaces the unsafe SnakeYAML loader with a safe configuration
Rotate any credentials, API tokens, or SSH keys stored on or accessible to HertzBeat instances that may have been exposed
Review authentication logs for unexpected low-privilege account activity between the vulnerable deployment window and patch application
Restrict network access to the HertzBeat management interface to trusted administrative networks only

Patch Information

The Apache HertzBeat project fixed the issue in version 1.6.0. Refer to the Apache Mailing List Thread for the vendor advisory. Download the patched release from the official Apache HertzBeat distribution channels and validate release signatures before deployment.

Workarounds

If upgrading is not immediately feasible, disable or block access to endpoints that accept YAML or configuration input from authenticated users
Enforce strict role-based access control so only administrators can reach configuration endpoints
Place HertzBeat behind a reverse proxy that inspects and rejects request bodies containing SnakeYAML !! tag markers

bash

# Verify the running HertzBeat version and upgrade
curl -s http://<hertzbeat-host>:1157/api/apps/hierarchy -H "Authorization: Bearer <token>" | grep version

# Pull the fixed release
wget https://dlcdn.apache.org/hertzbeat/1.6.0/apache-hertzbeat-1.6.0-incubating-bin.tar.gz

# Restrict access to the management port at the network layer
iptables -A INPUT -p tcp --dport 1157 -s <admin-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 1157 -j DROP