EUVD-2024-54781CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
Analysis
CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17, stemming from unsafe deserialization in the embedded HSQLDB database library. An authenticated attacker with local network access can execute arbitrary code with the privileges of the APLS service, potentially leading to complete system compromise. The vulnerability has a CVSS score of 8.0 and represents a significant risk to organizations using affected APLS versions, particularly given the authentication requirement is modest (PR:L) and the attack complexity is low.
Technical Context
The vulnerability resides in HPE AutoPass License Server's use of HSQLDB (HyperSQL Database), a Java-based embedded relational database engine. The root cause is classified as CWE-94 (Improper Control of Generation of Code - 'Code Injection'), which in this context specifically involves unsafe deserialization of untrusted data within HSQLDB's communication or serialization mechanisms. HSQLDB allows remote procedure calls and object serialization for inter-process communication; when input validation is insufficient, attackers can craft malicious serialized objects that execute arbitrary code upon deserialization. The affected CPE likely encompasses cpe:2.7.a:hpe:autopass_license_server:*:*:*:*:*:*:*:* with versions <9.17. APLS uses HSQLDB for its license database backend, making this library-level vulnerability directly exploitable through APLS interfaces.
Affected Products
HPE AutoPass License Server (APLS) versions prior to 9.17. Specific affected versions likely include 9.16 and earlier releases. The vulnerability affects any deployment where APLS is installed and exposed to authenticated users or local network access. Affected CPE: cpe:2.7.a:hpe:autopass_license_server:*:*:*:*:*:*:*:* where version < 9.17. Organizations should verify installed APLS version via the administrative console or package manager (dpkg/rpm on Linux, Windows Registry on Windows). Related components: HSQLDB library bundled within APLS installation directory (typically $APLS_HOME/lib/hsqldb.jar). No evidence of CVE cross-listing for specific HSQLDB versions in the description, but HSQLDB versions supporting unsafe deserialization are vulnerable.
Remediation
Immediate Actions: (1) UPGRADE to HPE AutoPass License Server 9.17 or later immediately. HPE has released patched versions that address the HSQLDB deserialization vulnerability. (2) If immediate upgrade is not feasible, implement these workarounds: (a) Restrict network access to APLS administrative interfaces using firewall rules—limit to trusted administrative networks only (whitelist source IPs); (b) Disable or restrict APLS REST API/remote access features if not required; (c) Apply network segmentation to isolate APLS servers from general user networks; (d) Monitor APLS logs for suspicious serialization activity or unusual object instantiation patterns. (3) Verify patch installation by confirming APLS version >= 9.17 via CLI or UI. (4) Consult HPE Security Advisory (references section) for detailed patch notes, rollback procedures, and verification steps. (5) After patching, review APLS access controls and authentication mechanisms to ensure principle of least privilege is enforced.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today