CVE-2024-51941
Published: 21 January 2025
Summary
CVE-2024-51941 is a high-severity Code Injection (CWE-94) vulnerability in Apache Ambari. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs such as alert definitions to prevent malicious code injection into the script execution path.
Requires timely remediation of the specific flaw in Ambari's alert processing via patching to the fixed version.
Enforces least privilege to restrict which authenticated users can submit or modify alert definitions, limiting exploitation opportunities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via code injection in public-facing Ambari server app enables T1190 exploitation; arbitrary command execution maps to T1059 interpreter abuse.
NVD Description
A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected into the alert script…
more
execution path. An attacker with authenticated access can exploit this vulnerability to execute arbitrary commands on the server. The issue has been fixed in the latest versions of Ambari.
Deeper analysisAI
CVE-2024-51941 is a remote code injection vulnerability (CWE-94) in the Ambari Metrics and AMS Alerts feature of Apache Ambari. The flaw arises during the processing of alert definitions, where malicious input can be injected into the alert script execution path, enabling authenticated users to execute arbitrary code. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-21.
An authenticated attacker can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting malicious alert definitions, the attacker can inject and execute arbitrary commands on the Ambari server, potentially leading to full compromise of the system.
The vulnerability has been fixed in the latest versions of Ambari. Additional details are available in the Apache mailing list advisory at https://lists.apache.org/thread/xq50nlff7o7z1kq3y637clzzl6mjhl8j and the OSS-Security announcement at http://www.openwall.com/lists/oss-security/2025/01/21/9.
Details
- CWE(s)