A critical LDAP injection vulnerability in Apache HertzBeat allows authenticated attackers to achieve arbitrary script execution, posing a significant risk to system integrity.

This flaw is an Improper Neutralization of Special Elements used in an LDAP Query (CWE-90). The vulnerability requires the attacker to hold an authenticated account and allows for the execution of arbitrary scripts through the submission of specifically crafted commands.

The ability to execute arbitrary scripts on the server represents a severe security risk that could lead to full system compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity because successful exploitation grants an attacker the ability to bypass security controls, potentially leading to unauthorized data access, modification, or total loss of system availability.

Immediate Action: Upgrade to Apache HertzBeat version 1.7.3 or later to apply the necessary security patches.

Proactive Monitoring: Review application and system access logs for anomalous LDAP query patterns or unexpected script execution attempts originating from authenticated user accounts.

Compensating Controls: Implement strict input validation and sanitization policies at the application level to prevent unauthorized LDAP query injection, and ensure that service accounts operate with the principle of least privilege.

Public Exploit Available: Unknown

The vulnerability in Apache HertzBeat is a significant security flaw that warrants immediate attention. Organizations should prioritize upgrading to version 1.7.3 to eliminate the risk of arbitrary script execution. Ensure that all user accounts are audited and that least-privilege access is enforced to minimize the impact of potential future vulnerabilities.