Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Vulnerability

Overview CVE-2023-49250 identifies a security flaw in Apache DolphinScheduler versions before 3.2.0. The HttpUtils class, used to make outgoing HTTPS requests, does not validate TLS server certificates. This means the class trusts any certificate presented during the TLS handshake, including those from an attacker operating as a man-in-the-middle (MITM) [1][3].

Exploitation

An attacker who can intercept network traffic between the DolphinScheduler instance and a target HTTPS server can exploit this flaw. By positioning themselves on the network path (e.g., on a compromised router, through ARP spoofing, or within the same cloud environment), they can present a self-signed or otherwise invalid certificate. Because HttpUtils does not verify the certificate's legitimacy, the attacker can impersonate any server the scheduler contacts [1][3].

Impact

Successful exploitation allows the attacker to eavesdrop on, modify, or inject data into the HTTPS communication. This could lead to disclosure of sensitive data (e.g., credentials, task configurations, or results) and compromise the integrity of data flowing into or out of the orchestration system [1].

Mitigation

The issue is fixed in Apache DolphinScheduler version 3.2.1. Users running versions prior to 3.2.0 are strongly advised to upgrade. The fix was introduced via pull request #15288, which ensures that HttpUtils validates server certificates and only communicates with trusted endpoints [3][4].