CVE-2024-23320 Overview
CVE-2024-23320 is an improper input validation vulnerability in Apache DolphinScheduler that allows an authenticated user to execute arbitrary, unsandboxed JavaScript on the server. The flaw is a regression of CVE-2023-49299, which the project did not fully remediate in its initial patch. All versions of Apache DolphinScheduler up to and including 3.2.0 are affected. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Critical Impact
Authenticated attackers can achieve remote code execution on the DolphinScheduler server through arbitrary JavaScript execution outside any sandbox, compromising confidentiality, integrity, and availability of the workflow scheduling platform.
Affected Products
- Apache DolphinScheduler versions prior to 3.2.1
- Deployments running the affected workflow scheduling components
- Systems where the fix from CVE-2023-49299 was incomplete
Discovery Timeline
- 2024-02-23 - CVE-2024-23320 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23320
Vulnerability Analysis
Apache DolphinScheduler is a distributed workflow scheduling platform used to orchestrate data pipelines. The vulnerability resides in server-side handling of user-supplied JavaScript expressions used by the scheduler. An authenticated user can submit JavaScript that the server evaluates without sandbox isolation. Because execution occurs in the server process context, an attacker obtains arbitrary code execution with the privileges of the DolphinScheduler service account.
This issue is classified under CWE-20: Improper Input Validation. The regression from CVE-2023-49299 indicates that the initial remediation did not cover all execution paths, and the maintainers issued a follow-up patch to close the remaining gaps.
Root Cause
The root cause is missing validation and insufficient sandboxing of JavaScript expressions accepted from authenticated users. The prior fix for CVE-2023-49299 addressed one execution path but left additional paths that reach the JavaScript engine. Attackers can craft input that reaches the unsandboxed evaluator, allowing native platform calls from within the script context.
Attack Vector
Exploitation requires network access to the DolphinScheduler web interface and valid user credentials. An authenticated user submits crafted JavaScript through a workflow definition or parameter field that the server later evaluates. The script executes with full access to the underlying Java runtime, enabling file system access, process execution, and lateral movement into connected data sources.
No public proof-of-concept has been published for CVE-2024-23320. For technical context, refer to the Apache DolphinScheduler pull request 15487 and the Openwall oss-security disclosure.
Detection Methods for CVE-2024-23320
Indicators of Compromise
- Unexpected child processes spawned by the DolphinScheduler Java process, such as shells, curl, wget, or scripting interpreters
- Workflow definitions containing JavaScript expressions that invoke Java reflection APIs, Runtime.getRuntime(), or ProcessBuilder
- Outbound network connections from the scheduler host to unfamiliar destinations shortly after workflow submission
- Modifications to task templates or parameter fields by low-privilege user accounts
Detection Strategies
- Audit DolphinScheduler application logs for JavaScript evaluation errors or unusually long expression payloads submitted by non-administrative users
- Correlate workflow creation and edit events with process execution telemetry on the scheduler host
- Alert on any invocation of java.lang.Runtime or java.lang.ProcessBuilder originating from the scripting engine at runtime
Monitoring Recommendations
- Enable verbose audit logging for workflow definition changes and forward events to a centralized SIEM
- Track authenticated session activity and flag users creating workflows with embedded script blocks
- Monitor egress traffic from scheduler nodes and baseline normal outbound destinations to detect anomalies
How to Mitigate CVE-2024-23320
Immediate Actions Required
- Upgrade Apache DolphinScheduler to version 3.2.1 or later, which contains the complete fix
- Rotate credentials for any account that could authenticate to affected instances before the upgrade
- Review existing workflow definitions for JavaScript expressions containing platform API calls and remove or quarantine suspicious entries
- Restrict network access to the DolphinScheduler web interface to trusted administrative networks
Patch Information
Apache released version 3.2.1 to fully remediate the JavaScript execution path that remained after CVE-2023-49299. The complete change set is available in pull request 15487. Additional maintainer discussion is published on the Apache announcement thread and the follow-up thread.
Workarounds
- Enforce strict role-based access control and remove workflow creation permissions from non-essential accounts until patching completes
- Place the DolphinScheduler service behind an authenticating reverse proxy with IP allowlisting
- Run the DolphinScheduler process under a dedicated low-privilege service account with minimal file system and network permissions to limit blast radius if exploited
# Verify installed DolphinScheduler version and upgrade
./bin/dolphinscheduler-daemon.sh status
# Stop the service before applying the upgrade to 3.2.1 or later
./bin/dolphinscheduler-daemon.sh stop all
# After deploying 3.2.1 binaries, restart
./bin/dolphinscheduler-daemon.sh start all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
