Security Resilience

CVE-2023-51653

Apache Hertzbeat ≤ 1.4.1

Public PoC
Published
22 February 2024
Modified
16 January 2025
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.021 81th percentile
Risk Priority 78 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-51653 is a critical-severity Injection (CWE-74) vulnerability in Apache Hertzbeat. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Hertzbeat is a real-time monitoring system affected by CVE-2023-51653, a JNDI injection vulnerability in the JMX collection logic implemented in JmxCollectImpl.java. The flaw resides in the handling of JMXConnectorFactory.connect calls exposed through the /api/monitor/detect endpoint; when a URL field is supplied, the provided address is used directly, allowing values such as service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari to trigger remote code execution. The issue is tracked under CWE-74 and carries a CVSS 3.1 score of 9.8.

An unauthenticated network attacker can exploit the vulnerability by submitting a crafted JMX service URL to the detection interface, resulting in arbitrary code execution on the Hertzbeat server with no required credentials or user interaction.

The associated GitHub security advisory GHSA-gcmp-vf6v-59gg and the referenced commit document that the flaw is resolved in version 1.4.1. The EPSS score remains low, with a modest peak of 0.0594 that has since declined, indicating limited observed exploitation interest.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`,…

more

it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.

CWE(s)
CWE-74

Related Threats

CVEs Like This One

CVE-2023-51388Same product: Apache Hertzbeat
CVE-2023-25613Same vendor: Apache
CVE-2023-25141Same vendor: Apache
CVE-2024-21742Same vendor: Apache
CVE-2023-33234Same vendor: Apache
CVE-2023-43667Same vendor: Apache
CVE-2024-36522Same vendor: Apache
CVE-2021-38294Same vendor: Apache
CVE-2020-13942Same vendor: Apache
CVE-2023-41834Same vendor: Apache

Affected Assets

apache
hertzbeat
≤ 1.4.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match
finds

Logging supports detection of injection attempts but does not prevent the weakness.

A.8.16 Monitoring activities partial match
finds

Monitoring activities can identify active injection attacks after they occur.

A.8.25 Secure development life cycle partial match
blocks

A.8.25 mandates a secure SDLC process that includes secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training to reduce injection flaws, but does not itself enforce or guarantee neutralization of special elements at runtime.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly call for controls against injection attacks in software design.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates security-by-design principles (including distrust external input, data validation/sanitization, secure architecture layers, and design reviews against attack patterns) that reach injection when applied to output construction; this stops exploitation for a minority slice (e.g. where principles drive sanitization) but leaves most code-level injection defects untouched without further implementation rigor.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements, directly addressing CWE-74.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-74, a class-level weakness, and none of its children carries one either.

References