DTStack Taier REST API Runtime.exec os command injection

Vulnerability

A stored OS command injection vulnerability exists in DTStack Taier version 1.4.0. The REST API endpoint accepts a sqlText parameter which is stored in MySQL without sanitization and later passed to Runtime.exec() with a sh -c prefix, allowing arbitrary command execution [1].

Exploitation

An attacker must have user credentials with task/job creation permissions to access the REST API. The attacker submits malicious SQL text containing shell metacharacters (e.g., ;, |, backticks) via the sqlText parameter. The input is stored in MySQL and subsequently executed when the job runs, resulting in command injection [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands on the server. This leads to full compromise of confidentiality, integrity, and availability, potentially enabling data exfiltration, system modification, or lateral movement [1].

Mitigation

The vendor did not respond to disclosure and no official fix is available. Users should restrict access to the REST API to trusted users, apply input validation to reject shell metacharacters, and consider using ProcessBuilder with explicit argument lists instead of Runtime.exec(). As of publication, Taier 1.4.0 remains vulnerable [1].