CVE-2023-49299

Apache DolphinScheduler up to 3.1.8 improperly validates input in a way that lets an authenticated user execute arbitrary, unsandboxed JavaScript on the server. DolphinScheduler orchestrates data workflows, so it already runs with reach into pipelines and the systems they touch — turning a legitimate logged-in user into an operator of unsandboxed server-side code collapses the boundary between using the scheduler and owning the host it runs on.

The authentication requirement is the main limiter and keeps this at 8.8 rather than higher, but it's a weaker limiter than it looks for an internal orchestration platform: these systems commonly hold many users, service accounts, and shared credentials, any of which a phisher or an insider can turn into this primitive. Once code runs unsandboxed, an attacker inherits the scheduler's access to data stores and downstream jobs.

We treat DolphinScheduler as a dependency and an access-control surface. The actions we drive are enumerating where it runs, confirming it's fenced off from untrusted networks, and getting instances onto 3.1.9 which fixes the issue. Because the trigger is an authenticated user, we also weight account hygiene — stale logins and over-shared credentials on the platform are the realistic ignition, so tightening them shrinks the exposure alongside the upgrade.