Title: TigerGraph_Community_Edition 4.2.4 - arbitrary file write Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux TigerGraph Community Edition 4.2.4 -- default credentials + arbitrary file write -> SSH RCE Vulnerability summary: TigerGraph Community Edition 4.2.4 in its default configuration permits a remote code-execution chain against the database host: 1. The GUI administration port (14240) accepts the hard-coded credentials tigergraph:tigergraph (CWE-798). There is no forced password change; the login response only carries an advisory securityRecommendations entry next to isSuperUser:true. 2. The GUI nginx reverse-proxies the GSQL statements endpoint (/api/gsql-server/gsql/v1/statements, proxied to the internal GSQL HTTP service on…