Apache DolphinScheduler: Alert Script Attack

Vulnerability

Overview

CVE-2024-43115 is an Improper Input Validation vulnerability in Apache DolphinScheduler that allows an authenticated user to execute arbitrary shell scripts on the server through the alert script functionality [1][3]. The root cause is insufficient validation of user-supplied input when processing alert scripts, enabling command injection.

Exploitation

An attacker must first authenticate to the DolphinScheduler instance. Once authenticated, they can craft a malicious alert script that bypasses input validation and executes arbitrary shell commands on the server. The attack does not require any special privileges beyond standard user access [3].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary shell commands on the DolphinScheduler server. This could lead to full compromise of the server, including data exfiltration, installation of backdoors, or lateral movement within the network.

Mitigation

The vulnerability affects all versions before 3.2.2. Users are recommended to upgrade to version 3.3.1, which contains the fix [1][3]. No workarounds have been publicly documented.