Apache DolphinScheduler: RCE by arbitrary js execution

Overview

CVE-2024-29831 is an improper input validation vulnerability in Apache DolphinScheduler that allows remote code execution (RCE). The flaw resides in the switch task plugin, where an authenticated user can inject and execute arbitrary, unsandboxed JavaScript on the server. This stems from insufficient sanitization or validation of user-supplied input within the switch task workflow [1][3].

Exploitation

An attacker must first gain authentication to the DolphinScheduler web interface. No special privileges beyond a standard authenticated session are required. The switch task plugin, a built-in component for conditional branching in workflows, accepts user-controlled input that is passed to a JavaScript engine without sandboxing. By crafting a malicious switch condition, an authenticated user can achieve arbitrary JavaScript execution on the server side [3]. This is a classic injection attack where user input is treated as code.

Impact

Successful exploitation grants the attacker the ability to execute arbitrary JavaScript code in the server's runtime context. This can be leveraged to perform further attacks such as data exfiltration, lateral movement, privilege escalation, or complete compromise of the DolphinScheduler instance. The vulnerability is rated as moderate severity, but it enables full RCE, making it highly dangerous in production environments [1][3].

Mitigation

The issue is patched in DolphinScheduler version 3.2.2. Users running versions through 3.2.1 who utilize the switch task plugin are strongly advised to upgrade immediately. No workarounds have been provided by the vendor [1][3].