CVE-2023-51650
📋 TL;DR
Hertzbeat versions before 1.4.1 have Spring Boot permission misconfigurations that allow unauthenticated access to three interfaces. This vulnerability enables attackers to access sensitive server information without authentication. All Hertzbeat deployments using affected versions are vulnerable.
💻 Affected Systems
- Hertzbeat
📦 What is this software?
Hertzbeat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to sensitive monitoring data, server configurations, and potentially pivot to other systems in the environment.
Likely Case
Unauthorized users access sensitive monitoring information and server details that could facilitate further attacks.
If Mitigated
Limited information disclosure if network segmentation restricts access, but authentication bypass remains.
🎯 Exploit Status
Exploitation requires only HTTP requests to vulnerable endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1
Vendor Advisory: https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Stop Hertzbeat service. 3. Update to version 1.4.1 or later. 4. Restart Hertzbeat service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to Hertzbeat instances using firewall rules.
iptables -A INPUT -p tcp --dport [hertzbeat-port] -s [trusted-network] -j ACCEPT
iptables -A INPUT -p tcp --dport [hertzbeat-port] -j DROP
Reverse Proxy Authentication
allPlace Hertzbeat behind a reverse proxy with authentication enabled.
🧯 If You Can't Patch
- Isolate Hertzbeat instances to internal networks only with strict firewall rules.
- Implement network segmentation and monitor for unauthorized access attempts to Hertzbeat endpoints.
🔍 How to Verify
Check if Vulnerable:
Check if accessing /api/account/auth/refresh, /api/monitors, or /api/alerts endpoints returns data without authentication.Check Version:
Check Hertzbeat web interface or application logs for version information, or run: java -jar hertzbeat.jar --versionVerify Fix Applied:
After patching, verify that unauthenticated requests to vulnerable endpoints return 401/403 errors.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /api/account/auth/refresh, /api/monitors, or /api/alerts endpoints
- Multiple 200 responses from unauthenticated sources
Network Indicators:
- Unusual traffic patterns to Hertzbeat API endpoints from unauthorized sources
- Data exfiltration from monitoring endpoints
SIEM Query:
source="hertzbeat" AND (uri_path="/api/account/auth/refresh" OR uri_path="/api/monitors" OR uri_path="/api/alerts") AND http_status=200 AND NOT authenticated_user=*