search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
878 stars 178 forks source link

PIP: Apache DolphinScheduler Default Credentials Tester with RCE #531

Open hayageek opened 2 months ago

hayageek commented 2 months ago

Hi Team, I would like to develop a plugin for Apache DolphinScheduler weak credentials Tester. for , Apache DolphinScheduler an open-source distributed workflow scheduler designed to manage complex data and task workflows across various systems efficiently.

The platform uses different credentials for its UI and Java Gateway API(based on https://github.com/py4j). The Java Gateway API, in particular, comes with a default authentication token.

For information on setting up DolphinScheduler using Docker, refer to the official documentation. The Docker image used is apache/dolphinscheduler-standalone-server:3.1.5.

According to the configuration guide, if DolphinScheduler is deployed with the Docker image (apache/dolphinscheduler-standalone-server), it uses the default auth token:

auth_token: jwUDzpLsNKEFER4*a8gruBH_GsAurNxU7A@Xc

Note that if the Java Gateway is exposed, it is possible for anyone to perform tasks (e.g., Shell, Python), which could lead to remote code execution (RCE).

tooryx commented 2 months ago

Hi @hayageek,

Let's wait on your 2 AI-PRP submissions before we take a decision on this one.

Cheers, ~tooryx