CVE-2024-7314
📋 TL;DR
CVE-2024-7314 is an authentication bypass vulnerability in anji-plus AJ-Report that allows unauthenticated attackers to execute arbitrary Java code on vulnerable servers by appending ";swagger-ui" to HTTP requests. This affects all organizations running vulnerable versions of AJ-Report, particularly those with internet-facing instances. The vulnerability has been actively exploited in the wild since February 2025.
💻 Affected Systems
- anji-plus AJ-Report
📦 What is this software?
Report by Anji Plus
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary Java code, steal sensitive data, deploy ransomware, or establish persistent backdoors on affected servers.
Likely Case
Attackers exploiting the vulnerability to deploy cryptocurrency miners, establish command and control channels, or exfiltrate sensitive report data from the system.
If Mitigated
Limited impact if proper network segmentation, egress filtering, and monitoring are in place, though authentication bypass still provides initial access.
🎯 Exploit Status
Multiple public exploit scripts exist, and Shadowserver Foundation observed active exploitation in the wild on February 5, 2025.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references (check vendor advisory)
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Check for official patch from anji-plus AJ-Report vendor. 2. Apply the patch to all affected systems. 3. Restart the AJ-Report service. 4. Verify the fix by testing the vulnerability.
🔧 Temporary Workarounds
Block Swagger UI Endpoint
allConfigure web application firewall or reverse proxy to block requests containing ";swagger-ui" in the URL path
# Example nginx configuration:
location ~* ";swagger-ui" {
deny all;
return 403;
}
Network Access Control
linuxRestrict access to AJ-Report instances to trusted IP addresses only
# Example iptables rule:
iptables -A INPUT -p tcp --dport [AJ-Report-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [AJ-Report-port] -j DROP
🧯 If You Can't Patch
- Immediately take affected systems offline or isolate them from the network
- Implement strict network segmentation and monitor all traffic to/from AJ-Report instances
🔍 How to Verify
Check if Vulnerable:
Test by accessing http://[target]:[port]/[context-path];swagger-ui and checking if authentication is bypassed. Use curl: curl -v http://target:port/;swagger-uiCheck Version:
Check AJ-Report version in web interface or application logs. No standard command provided in documentation.Verify Fix Applied:
Attempt the same bypass technique after patching - it should return authentication required or 404 error📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ";swagger-ui" in URL
- Unauthenticated access to administrative endpoints
- Unusual Java process execution
Network Indicators:
- HTTP requests with ";swagger-ui" suffix
- Outbound connections from AJ-Report to suspicious IPs
- Unusual spikes in traffic to AJ-Report endpoints
SIEM Query:
http.url:"*;swagger-ui*" OR http.uri:"*;swagger-ui*"