| शीर्षक | PowerJob 5.1.0/5.1.1/5.1.2 Code Injection |
|---|
| विवरण | A code injection vulnerability was found in PowerJob up to version 5.1.2. The OpenAPI endpoints are unauthenticated by default (oms.auth.openapi.enable defaults to false). An unauthenticated attacker can create a workflow with a DECISION node containing a malicious Groovy script via /openApi/addWorkflowNode, then trigger execution via /openApi/runWorkflow. The Groovy script is executed by GroovyEvaluator.evaluate() on the server JVM without any sandbox, leading to pre-authentication Remote Code Execution (RCE). The manipulation leads to code injection via the nodeParams parameter. The attack can be initiated remotely without authentication. |
|---|
| स्रोत | ⚠️ https://github.com/PowerJob/PowerJob/issues/1168 |
|---|
| उपयोगकर्ता | anch0r (UID 96691) |
|---|
| सबमिशन | 24/03/2026 09:21 AM (7 महीनों पहले) |
|---|
| संयम | 07/04/2026 03:38 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355747 [PowerJob 5.1.0/5.1.1/5.1.2 OpenAPI Endpoint /openApi/addWorkflowNode GroovyEvaluator.evaluate nodeParams अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|