Apache DolphinScheduler: Session do not expire after password change

Vulnerability

CVE-2023-50270 is a session fixation vulnerability in Apache DolphinScheduler versions prior to 3.2.0. The root cause is that the application does not invalidate the user's session after a password change, meaning the old session token remains valid indefinitely [1][3]. This violates the security best practice that a session should be regenerated following sensitive operations like credential rotation.

Exploitation

An attacker can exploit this by first obtaining a valid session token for a target user—potentially via social engineering, network sniffing, or other means. If the user later changes their password (for example, as part of routine maintenance or after a suspected compromise), the attacker's captured session token is still accepted by the server, allowing continued access without knowledge of the new password [3]. No additional authentication is required once the token is obtained.

Impact

A successful attacker gains persistent unauthorized access to the victim's account, with all associated privileges in DolphinScheduler. This could include the ability to view, create, modify, or delete workflows, access data sources, and manage project permissions, depending on the compromised user's role [2]. The confidentiality, integrity, and availability of the orchestration platform may be significantly impacted.

Mitigation

The vulnerability is fixed in Apache DolphinScheduler version 3.2.1 [1][3]. Users running versions 1.3.8 through 3.2.0 should upgrade immediately. No workarounds are documented; upgrading is the recommended action. The issue was reported by lujiefsi [3] and is classified as important severity.