| शीर्षक | xuxueli XXL-JOB 3.4.2 Improper Control of Generation of Code |
|---|
| विवरण | A vulnerability was found in Xuxueli xxl-job version 3.4.2. It has been classified as critical. The affected component is the GlueFactory class in xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. The function GroovyClassLoader.parseClass() compiles user-provided Groovy source code without any sandbox restrictions. No SecureASTCustomizer or CompilerConfiguration is applied, allowing arbitrary Java/Groovy code execution including Runtime.exec(). This vulnerability allows Remote Code Execution (RCE) via the web interface without requiring administrator access. A normal authenticated user with jobGroup permissions can create a GLUE_GROOVY type job containing arbitrary malicious code, which executes on the executor server with full system privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
|---|
| स्रोत | ⚠️ https://github.com/zhaizejiang/xxl-job-vuln-poc/blob/main/xxl-job%20v3.4.2%20Remote%20Code%20Execution%20via%20Groovy%20Code%20Execution.md |
|---|
| उपयोगकर्ता | zhaizejiang (UID 99755) |
|---|
| सबमिशन | 14/07/2026 05:52 AM (2 महीनों पहले) |
|---|
| संयम | 12/09/2026 10:04 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403076 [Xuxueli xxl-job तक 3.4.2 GlueFactory.java GroovyClassLoader.parseClass अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|