CVE-2024-45505: Apache HertzBeat Command Injection RCE

CVE-2024-45505 Overview

CVE-2024-45505 is a command injection vulnerability in Apache HertzBeat (incubating), an open source real-time monitoring system. The flaw stems from improper neutralization of special elements passed to a command interpreter [CWE-77]. Authenticated attackers can inject operating system commands through the affected component and achieve execution in the HertzBeat process context. The vulnerability affects all Apache HertzBeat versions prior to 1.6.1. Apache addressed the issue in version 1.6.1.

Critical Impact
Authenticated attackers can execute arbitrary commands on the HertzBeat host, compromising monitoring infrastructure and any monitored assets reachable from the server.

Affected Products

Apache HertzBeat (incubating) versions before 1.6.1
Deployments exposing the HertzBeat web console to authenticated users
Containerized and self-hosted HertzBeat monitoring stacks

Discovery Timeline

2024-11-18 - CVE-2024-45505 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45505

Vulnerability Analysis

Apache HertzBeat is a Java-based monitoring platform that collects metrics from endpoints, applications, and infrastructure. The vulnerability is classified under [CWE-77] — improper neutralization of special elements used in a command. Authenticated users can supply crafted input that HertzBeat forwards to a command interpreter without sufficient sanitization. The interpreter executes attacker-controlled operators or arguments alongside the intended command.

Successful exploitation grants command execution with the privileges of the HertzBeat service account. Because HertzBeat commonly holds credentials for monitored systems, downstream systems inherit the risk. The EPSS probability of exploitation is 2.21% at the 81st percentile, indicating measurable interest relative to the broader CVE population.

Root Cause

The root cause is the construction of shell or process invocations from user-supplied strings without strict allow-list validation or safe argument passing. When special shell metacharacters such as ;, |, &&, backticks, or $() are not neutralized, the command interpreter treats them as control operators. HertzBeat therefore executes attacker-defined commands in addition to the expected operation.

Attack Vector

The attack vector is network-based and requires valid credentials to the HertzBeat console or API. An authenticated attacker submits a request to the vulnerable endpoint containing payload data with embedded shell metacharacters. The server passes this payload into a command pipeline, and the injected commands run under the HertzBeat process identity. From this foothold, an attacker can pivot to monitored assets, exfiltrate stored monitoring credentials, deploy persistence, or disrupt observability.

No verified public proof-of-concept is currently referenced in the advisory. Refer to the Apache Mailing List Discussion and the Apache Mailing List Thread for the vendor disclosure.

Detection Methods for CVE-2024-45505

Indicators of Compromise

HertzBeat request logs containing shell metacharacters such as ;, |, &&, `, or $() in monitor configuration or task parameters.
Unexpected child processes spawned by the HertzBeat Java process, including sh, bash, cmd.exe, powershell.exe, curl, or wget.
Outbound network connections from the HertzBeat host to previously unseen destinations shortly after console activity.
New scheduled tasks, cron entries, or SSH keys created on the HertzBeat host without change control.

Detection Strategies

Alert on process ancestry where the HertzBeat JVM spawns interactive shells or scripting interpreters.
Correlate authenticated HertzBeat API calls with subsequent process creation events on the same host within a short window.
Inspect HTTP request bodies to HertzBeat endpoints for shell metacharacters using a web application firewall or reverse proxy log parser.

Monitoring Recommendations

Ingest HertzBeat application logs, host process telemetry, and network flow data into a central analytics platform for cross-source correlation.
Baseline normal command execution behavior of the HertzBeat service account and alert on deviations.
Track authentication events to the HertzBeat console and flag account creation, role changes, or logins from atypical source addresses.

How to Mitigate CVE-2024-45505

Immediate Actions Required

Upgrade Apache HertzBeat to version 1.6.1 or later on all instances.
Rotate credentials stored inside HertzBeat monitor definitions, including SSH, database, and API secrets.
Audit HertzBeat user accounts and remove unused or overly privileged users.
Review host logs and process history on HertzBeat servers for signs of prior exploitation.

Patch Information

Apache released the fix in Apache HertzBeat 1.6.1. Users of all prior versions must upgrade. Confirm the running version through the HertzBeat administrative interface or the application manifest after deployment. See the Apache Mailing List Discussion and the OpenWall OSS Security Update for release details.

Workarounds

Restrict network access to the HertzBeat console to trusted administrative networks using firewall or reverse proxy allow-lists.
Enforce strong authentication and unique credentials for every HertzBeat account, and disable default or shared logins.
Run HertzBeat under a dedicated low-privilege service account with no interactive shell and limited filesystem access.
Deploy HertzBeat in a container or sandbox with egress filtering to constrain the impact of any successful command injection.

bash

# Configuration example: verify installed version and upgrade path
# Check current HertzBeat version
curl -s http://<hertzbeat-host>:1157/api/apps/hierarchy | head -n 5

# Recommended upgrade using Docker
docker pull apache/hertzbeat:1.6.1
docker stop hertzbeat && docker rm hertzbeat
docker run -d --name hertzbeat \
  -p 1157:1157 -p 1158:1158 \
  --restart=always \
  apache/hertzbeat:1.6.1