Remote Code Execution in Apache Dolphinscheduler

Vulnerability

Overview

CVE-2023-49109 is a remote code execution (RCE) vulnerability in Apache DolphinScheduler, affecting versions before 3.2.1 [1][3]. The issue stems from insufficient input validation or improper handling of certain resources, which allows an attacker to execute arbitrary code on the server. The exact root cause appears to be related to a resource quota mechanism that could be manipulated; a related pull request (PR #14991) removes ResourceQuota functionality as part of the fix [4].

Exploitation

To exploit this vulnerability, an attacker likely needs to be an authenticated user with permissions to submit or manage workflows. By crafting a malicious workflow or manipulating resource quota settings, the attacker can inject and execute arbitrary commands on the DolphinScheduler master or worker nodes. The attack surface includes the web UI, API, or Python SDK, which are all used to define task types and dependencies [2].

Impact

Successful exploitation results in full remote code execution on the server, allowing the attacker to compromise the DolphinScheduler instance. This could lead to data exfiltration, service disruption, lateral movement within the network, and further compromise of interconnected systems. The vulnerability is rated as important severity by the Apache project [3].

Mitigation

The vulnerability is fixed in Apache DolphinScheduler version 3.2.1 [1]. Users are strongly advised to upgrade all installations as soon as possible. No workarounds have been officially released; upgrading is the only recommended mitigation. The CVE was publicly disclosed on February 20, 2024 [3].