CVE-2023-51388

In the `CalculateAlarm.java` file, the `AviatorEvaluator` component executes expressions passed as input without any security restrictions. The AviatorScript engine by default allows calling arbitrary static Java methods, meaning an attacker can inject a malicious expression and execute arbitrary code at the operating system level. The lack of security policy configuration (sandbox) makes the exploit trivial to perform remotely without authentication.

An attacker can remotely execute arbitrary code on the server (RCE), leading to complete system compromise, data exposure, configuration modification, or complete service availability disruption.

Apache Hertzbeat should be updated to version 1.4.1, which eliminates this vulnerability by implementing proper security policy for AviatorEvaluator. Patch details are available in the vendor references on GitHub.

Apache Hertzbeat in versions prior to 1.4.1