Apache DolphinScheduler: Resource File Read And Write Vulnerability

Vulnerability

CVE-2024-30188 is a file read and write vulnerability in Apache DolphinScheduler, an open-source distributed workflow scheduler. The issue stems from insufficient access control checks, allowing authenticated users to access resource files that they should not be able to read or write. This affects versions from 3.1.0 up to (but not including) 3.2.2 [1].

Exploitation

An attacker must have a valid authenticated session in DolphinScheduler. No special privileges are required beyond standard user authentication. The vulnerability can be exploited by manipulating file access requests to bypass intended restrictions, enabling the attacker to read or write arbitrary resource files stored on the server.

Impact

Successful exploitation allows an attacker to read sensitive information from other users' resource files, such as configuration data or scripts, and potentially write malicious content to files, leading to further compromise of the system's data integrity and confidentiality.

Mitigation

The Apache Software Foundation has fixed this vulnerability in DolphinScheduler version 3.2.2. Users are strongly recommended to upgrade to this version or later to mitigate the risk. No workarounds are known for unpatched versions.