Expression Injection Vulnerability in Hertzbeat

CVE-2023-51387

What is CVE-2023-51387?

Hertzbeat, an open-source real-time monitoring system developed by Dromara, suffers from a command injection vulnerability caused by improper sanitization of alert expressions. This issue allows an attacker who has access to the alert definition capability to craft malicious alert expressions, potentially enabling them to execute arbitrary commands on the Hertzbeat server. The vulnerability has been addressed in version 1.4.1, which reinforces input validation, thereby mitigating the risk of such command execution.

References