Hertzbeat is a real-time monitoring system. In the implementation of JmxCollectImpl.java
, JMXConnectorFactory.connect
is vulnerable to JNDI injection. The corresponding interface is /api/monitor/detect
. If there is a URL field, the address will be used by default. When the URL is service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari
, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.