CVE-2023-29921

Vulnerability

Description CVE-2023-29921 is an incorrect access control vulnerability in PowerJob V4.3.1, an open-source distributed job scheduling framework. The /appInfo/save interface lacks authentication, allowing any unauthenticated user to create new application entries by simply sending a POST request with an application name and password [1][3].

Exploitation

The attack requires no authentication or special privileges. An attacker can send a crafted HTTP POST request to /appInfo/save with JSON payload containing arbitrary appName and password fields. The official issue tracker provides a concrete request example that successfully creates an application without any permission checks [3]. Network access to the PowerJob server (default port 7700) is sufficient.

Impact

Successful exploitation enables an attacker to create arbitrary applications in the PowerJob system. These rogue applications can then be used to log in to the backend with attacker-controlled credentials, potentially leading to unauthorized job scheduling, monitoring, and manipulation of distributed tasks. This could result in execution of arbitrary code on worker nodes or disruption of business-critical scheduled jobs.

Mitigation

As of the advisory publication, PowerJob V4.3.1 is affected. The vendor has been notified via the GitHub issue tracker [3]. Users should apply any patches made available by the PowerJob team or restrict network access to the /appInfo/save endpoint via firewall rules or reverse proxy configurations until an official fix is released.