Apache Dolphinscheduler 代码注入漏洞

The RCE vulnerability in Apache Dolphinscheduler poses a significant threat. An attacker could exploit this flaw to gain complete control over the server hosting the Dolphinscheduler instance. This could lead to data breaches, system compromise, and further lateral movement within the network. The attacker could potentially steal sensitive data, modify configurations, or even use the compromised server as a launchpad for attacks against other systems. The potential blast radius is substantial, particularly in environments where Dolphinscheduler is used to orchestrate critical workflows.

Organizations heavily reliant on Apache Dolphinscheduler for workflow orchestration are particularly at risk. This includes data engineering teams, DevOps pipelines, and any environment where Dolphinscheduler manages critical processes. Shared hosting environments running Dolphinscheduler are also at increased risk due to potential cross-tenant vulnerabilities.

• java / server:

ps aux | grep dolphinscheduler

• java / server:

journalctl -u dolphinscheduler -f | grep "error"

• generic web:

curl -I http://<dolphinscheduler_ip>/api/task/submit

• generic web:

 grep -r "/api/task/submit" /var/log/apache2/access.log

1. 2024-08-20Disclosure

   disclosure

1. 已保留2024-08-07
2. 发布日期2024-08-20
3. 修改日期2025-03-19
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-43202 is to immediately upgrade Apache Dolphinscheduler to version 3.2.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the Dolphinscheduler API. Review and harden the Dolphinscheduler configuration, paying close attention to authentication and authorization settings. Monitor system logs for any suspicious activity related to Dolphinscheduler. After upgrading, confirm the fix by attempting to trigger the vulnerable API endpoint and verifying that it no longer executes arbitrary code.