Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin

Vulnerability

Description

CVE-2022-45875 is a remote command execution vulnerability in the Apache DolphinScheduler script alert plugin. The plugin fails to properly validate parameters passed to it, allowing an attacker to inject arbitrary commands. This issue stems from insufficient input sanitization, which can be exploited by an authenticated user [1][3].

Exploitation

Conditions

The attack requires the attacker to have valid credentials to log into the DolphinScheduler web interface. Once authenticated, the attacker can craft malicious parameters within the script alert plugin to execute arbitrary commands on the server. The vulnerability affects versions 3.0.1 and prior, as well as versions 3.1.0 and prior [1][3]. The attack can be performed remotely if the DolphinScheduler web UI is accessible over the network.

Impact

Successful exploitation allows an attacker to execute arbitrary commands within the context of the DolphinScheduler service, potentially leading to full compromise of the server, data exfiltration, or disruption of workflows. Given DolphinScheduler's role as a data orchestration platform, this could have significant impact on data pipelines and integrated systems.

Mitigation

The Apache DolphinScheduler project has addressed this issue in subsequent releases. Users are strongly advised to upgrade to the latest version of DolphinScheduler to remediate this vulnerability. No workarounds have been identified for the affected versions [1][3].