CVE-2024-29831 Overview
CVE-2024-29831 is an improper input validation vulnerability in Apache DolphinScheduler affecting the switch task plugin. An authenticated user can trigger execution of arbitrary, unsandboxed JavaScript on the server. The flaw is tracked under [CWE-20] Improper Input Validation and impacts confidentiality, integrity, and availability of the DolphinScheduler host.
Apache addressed the vulnerability in DolphinScheduler version 3.2.2. Organizations running earlier releases with the switch task plugin enabled should upgrade immediately. The vulnerability requires only low-privilege authentication and network access, making it viable for insider threats or attackers who have obtained user credentials.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript on DolphinScheduler servers without sandbox restrictions, leading to full system compromise.
Affected Products
- Apache DolphinScheduler versions prior to 3.2.2
- DolphinScheduler deployments using the switch task plugin
- All platforms hosting vulnerable DolphinScheduler instances
Discovery Timeline
- 2024-08-12 - CVE-2024-29831 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29831
Vulnerability Analysis
The vulnerability resides in the switch task plugin of Apache DolphinScheduler. The plugin evaluates user-supplied conditional expressions using a JavaScript execution engine. DolphinScheduler fails to properly validate or sandbox the JavaScript payload before evaluation.
An authenticated user with permission to create or modify workflows can craft a switch task containing arbitrary JavaScript. When the workflow executes, the server evaluates the code directly. Because the execution occurs outside any sandbox, the code has access to Java runtime primitives and host system resources through the scripting engine.
This enables attackers to invoke java.lang.Runtime operations, read arbitrary files, and pivot into the host operating system. The scope remains unchanged because execution occurs within the DolphinScheduler process context.
Root Cause
The root cause is the absence of input validation and sandboxing on JavaScript expressions passed to the switch task plugin. The plugin passes user-controlled strings directly to the JavaScript engine without allow-listing permitted syntax or restricting object access.
Attack Vector
An attacker authenticates to DolphinScheduler with any account that can create workflows. The attacker configures a switch task with a malicious JavaScript condition. Upon workflow execution, the server evaluates the payload and executes attacker-supplied code with the privileges of the DolphinScheduler service account.
The vulnerability requires no user interaction beyond the authenticated attacker's own actions. See the Apache Thread Discussion and the Openwall OSS Security Posting for additional technical context.
Detection Methods for CVE-2024-29831
Indicators of Compromise
- Unexpected child processes spawned by the DolphinScheduler Java process, particularly shell interpreters or network utilities
- Switch task definitions containing suspicious JavaScript constructs referencing java.lang.Runtime, ProcessBuilder, or file system APIs
- Outbound network connections from DolphinScheduler workers to unfamiliar external hosts
- New or modified workflow definitions created by low-privilege accounts
Detection Strategies
- Audit workflow definitions in the DolphinScheduler metadata database for switch tasks referencing Java classes or system calls within JavaScript expressions
- Monitor application logs for switch task execution events correlated with anomalous process creation on worker nodes
- Baseline the process tree of DolphinScheduler workers and alert on deviations such as /bin/sh, bash, curl, or wget invocations
Monitoring Recommendations
- Enable verbose logging for the switch task plugin and forward logs to a centralized SIEM for correlation
- Track authentication events and workflow modification actions for privileged and standard user accounts
- Alert on outbound network traffic from DolphinScheduler hosts to non-approved destinations
How to Mitigate CVE-2024-29831
Immediate Actions Required
- Upgrade Apache DolphinScheduler to version 3.2.2 or later without delay
- Inventory all workflows using the switch task plugin and review their JavaScript expressions for malicious content
- Rotate credentials for DolphinScheduler user accounts if compromise is suspected
- Restrict network access to the DolphinScheduler web interface using firewall rules or reverse proxy authentication
Patch Information
Apache released DolphinScheduler 3.2.2 to remediate CVE-2024-29831. The fix introduces input validation for switch task expressions. Refer to the Apache Thread Discussion for release details and upgrade guidance.
Workarounds
- Disable the switch task plugin if it is not required for production workflows
- Restrict workflow creation and modification permissions to trusted administrators until the patch is applied
- Deploy DolphinScheduler workers in isolated network segments with strict egress filtering to limit lateral movement
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
