Critical · published February 22, 2024
🚨 A sneaky script injection lurks in Hertzbeat's real-time monitoring system, ready to execute any static method without a security policy! 🔥 Think of it like a restaurant that allows any chef to walk in and cook without checking their credentials — anyone can whip up a dish that could leave patrons with a stomach ache! An attacker could run malicious scripts that could tamper with system operations, leading to unauthorized access, data breaches, or even full system compromise. The consequences could be absolutely devastating, putting your entire monitoring system at risk!
Think of it like a restaurant that allows any chef to walk in and cook without checking their credentials — anyone can whip up a dish that could leave patrons with a stomach ache! This vulnerability arises from the use of `AviatorEvaluator` in `CalculateAlarm.java`, which executes expressions without any security policy, allowing for script injection and execution of arbitrary static methods.
An attacker could run malicious scripts that could tamper with system operations, leading to unauthorized access, data breaches, or even full system compromise. The consequences could be absolutely devastating, putting your entire monitoring system at risk! To safeguard your system, patch Hertzbeat to version 1.4.1 immediately. Additionally, review and implement security policies for script execution to prevent any unauthorized access in the future. You've got this! By updating and securing your scripts, you’ll keep your monitoring system safe and sound! 🛡️