Apache HertzBeat 1.8.0 allows authenticated users to execute arbitrary OS commands via the scriptCommand parameter in monitoring templates. The vulnerability exists in ScriptCollectImpl.collect() when processing script protocol definitions, where unsanitized user input is passed to ProcessBuilder (bash -c) for execution. Attackers can overwrite monitoring templates via PUT /api/apps/define/yml and trigger execution through active monitoring instances or by creating new ones.
| Vendor | Product | Versions |
|---|---|---|
| apache | hertzbeat | 1.8.0 |
