CVE-2020-11974

Vulnerability

Overview The vulnerability exists in Apache DolphinScheduler versions 1.2.0 and 1.2.1 when MySQL is selected as the database, specifically through the MySQL Connector/J driver. The exact mechanism involves improper handling of JDBC connection parameters, allowing an attacker to inject malicious code.

Attack

Vector To exploit this vulnerability, an attacker must be able to influence the JDBC connection configuration when DolphinScheduler is set to use MySQL. This could occur if an attacker has control over database connection settings (e.g., via configuration files or network injection). The attack does not require authentication to DolphinScheduler itself but requires the ability to modify the JDBC URL or driver settings.

Impact

Successful exploitation leads to remote code execution on the DolphinScheduler server. An attacker could execute arbitrary commands, potentially compromising the entire system and its data.

Mitigation

The vulnerability has been addressed in later versions of DolphinScheduler (post 1.2.1). Users are advised to upgrade to a patched release. As of the publication date, no workaround is documented. The issue is tracked as CVE-2020-11974 and referenced in related security advisories [1][2].