Summary
Dromara Skyeye bundles xxl-job-admin endpoints that can accept and start certain script-based jobs without authentication. An unauthenticated attacker may submit attacker-controlled job content, potentially executing commands on executor hosts or disrupting scheduled jobs.
Dromara Skyeye bundles xxl-job-admin endpoints that can accept and start certain script-based jobs without authentication. An unauthenticated attacker may submit attacker-controlled job content, potentially executing commands on executor hosts or disrupting scheduled jobs.
Affected context
The vulnerability occurs in bundled xxl-job-admin JobInfoController endpoints where authentication is disabled through @PermissionLimit(limit = false). Deployments may be at risk when these endpoints are network-accessible and permit GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs to be created and started with attacker-controlled glueSource.
The vulnerability occurs in bundled xxl-job-admin JobInfoController endpoints where authentication is disabled through @PermissionLimit(limit = false). Deployments may be at risk when these endpoints are network-accessible and permit GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs to be created and started with attacker-controlled glueSource.
Exploit preconditions
- Attack surface: xxl-job-admin JobInfoController job-management endpoints
- Required access: No authentication, if the affected endpoints are reachable
- Trigger point: Job creation and startup through
/jobinfo/addAndStart - Required input: A supported script-based job type and attacker-controlled job source
- Why exploitation is possible: Authentication and authorization checks are disabled for the affected operation, allowing untrusted callers to submit executable job content
- Attack surface: xxl-job-admin JobInfoController job-management endpoints
- Required access: No authentication, if the affected endpoints are reachable
- Trigger point: Job creation and startup through
/jobinfo/addAndStart - Required input: A supported script-based job type and attacker-controlled job source
- Why exploitation is possible: Authentication and authorization checks are disabled for the affected operation, allowing untrusted callers to submit executable job content
Why this happens
The underlying flaw is an authorization boundary failure. Sensitive job-management endpoints are explicitly configured to bypass permission checks, allowing unauthenticated requests to perform actions that should require an authenticated and authorized operator.
This maps to CWE-306: Missing Authentication for Critical Function, because the application does not verify the identity of a caller before allowing creation and execution of jobs capable of running commands on executor hosts.
The underlying flaw is an authorization boundary failure. Sensitive job-management endpoints are explicitly configured to bypass permission checks, allowing unauthenticated requests to perform actions that should require an authenticated and authorized operator.
This maps to CWE-306: Missing Authentication for Critical Function, because the application does not verify the identity of a caller before allowing creation and execution of jobs capable of running commands on executor hosts.
Potential impact
- An unauthenticated attacker may execute commands on connected executor hosts
- Attackers could alter, stop, or delete scheduled jobs
- Sensitive data accessible to executor processes could be exposed
- Attackers may disrupt workflows or corrupt operational processes
- Compromised executors could provide a path to further internal compromise
- An unauthenticated attacker may execute commands on connected executor hosts
- Attackers could alter, stop, or delete scheduled jobs
- Sensitive data accessible to executor processes could be exposed
- Attackers may disrupt workflows or corrupt operational processes
- Compromised executors could provide a path to further internal compromise
General mitigation guidance
Mitigation should focus on restoring authentication and authorization for every job-management operation.
Common defensive patterns include:
- Require strong authentication before creating, starting, stopping, or deleting jobs
- Apply object-level authorization so users can operate only on permitted jobs and executors
- Remove unauthenticated permission bypass annotations from sensitive endpoints
- Treat submitted script content as highly privileged and restrict who may create or run it
- Run executor processes with least-privilege accounts, isolated permissions, and limited network access
- Use secure-by-default administrative interfaces that deny access unless explicitly authorized
- Enforce network controls so job-admin endpoints are not broadly exposed
Mitigation should focus on restoring authentication and authorization for every job-management operation.
Common defensive patterns include:
- Require strong authentication before creating, starting, stopping, or deleting jobs
- Apply object-level authorization so users can operate only on permitted jobs and executors
- Remove unauthenticated permission bypass annotations from sensitive endpoints
- Treat submitted script content as highly privileged and restrict who may create or run it
- Run executor processes with least-privilege accounts, isolated permissions, and limited network access
- Use secure-by-default administrative interfaces that deny access unless explicitly authorized
- Enforce network controls so job-admin endpoints are not broadly exposed
How teams detect issues like this
Organizations can identify similar weaknesses through:
- Static analysis rules for authentication-bypass annotations or disabled permission checks
- Code review searches for administrative endpoints that accept state-changing POST requests without authorization
- Tests that invoke job creation and execution APIs without credentials and verify access is denied
- API inventory and policy checks requiring authentication on administrative routes
- Runtime monitoring for unexpected unauthenticated requests to job-management endpoints
- Alerts on unusual creation, startup, stopping, or deletion of jobs and unexpected script payloads
Automated code review and API security tools can help identify missing authentication and authorization coverage.
Organizations can identify similar weaknesses through:
- Static analysis rules for authentication-bypass annotations or disabled permission checks
- Code review searches for administrative endpoints that accept state-changing POST requests without authorization
- Tests that invoke job creation and execution APIs without credentials and verify access is denied
- API inventory and policy checks requiring authentication on administrative routes
- Runtime monitoring for unexpected unauthenticated requests to job-management endpoints
- Alerts on unusual creation, startup, stopping, or deletion of jobs and unexpected script payloads
Automated code review and API security tools can help identify missing authentication and authorization coverage.
