CVE-2023-29924

Vulnerability

Overview

PowerJob V4.3.1 contains an incorrect access control vulnerability that allows remote code execution. The issue arises from insufficient authorization checks in the job scheduling API, permitting unauthenticated users to invoke administrative functions [1].

Exploitation

An attacker can exploit this by sending specially crafted HTTP requests to the PowerJob server's job management endpoints. No prior authentication is required, and the attacker only needs network access to the vulnerable service [3].

Impact

Successful exploitation grants the attacker arbitrary code execution on the server, potentially leading to full compromise of the PowerJob instance and underlying infrastructure.

Mitigation

As of the publication date, a fix has not been released. Administrators are advised to restrict network access to PowerJob servers and monitor for updates from the vendor [2].