CVE-2024-30188: Apache DolphinScheduler File Read Flaw

CVE-2024-30188 Overview

CVE-2024-30188 is a file read and write vulnerability in Apache DolphinScheduler that allows authenticated users to illegally access additional resource files. The flaw affects Apache DolphinScheduler versions from 3.1.0 before 3.2.2. Apache DolphinScheduler is a distributed and extensible open-source workflow orchestration platform used for scheduling data pipelines across enterprise environments. The vulnerability is classified under [CWE-20] Improper Input Validation and enables an authenticated attacker to escape intended resource boundaries and interact with files outside the authorized scope.

Critical Impact
Authenticated attackers can read and write arbitrary resource files on the DolphinScheduler server, exposing sensitive configuration data, credentials, and workflow definitions while enabling tampering that can compromise workflow integrity.

Affected Products

Apache DolphinScheduler 3.1.0 through versions prior to 3.2.2
Deployments exposing the DolphinScheduler web UI or API to authenticated users
Environments where low-privilege DolphinScheduler accounts are provisioned to multiple tenants

Discovery Timeline

2024-08-12 - CVE-2024-30188 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30188

Vulnerability Analysis

The vulnerability resides in the resource file handling logic of Apache DolphinScheduler. Authenticated users can craft requests that reference resource file paths outside their permitted scope. Because the server does not sufficiently validate the supplied file identifiers, the request is honored and the file operation proceeds against files the user should not access.

The issue permits both read and write operations, meaning an attacker can exfiltrate configuration files, secrets stored on disk, or workflow artifacts owned by other tenants, and can also modify or overwrite resource files. Manipulating resource files can, in turn, alter the behavior of scheduled workflows executed by DolphinScheduler workers. This vulnerability requires network access and valid low-privilege credentials, but does not require user interaction, and it has been assigned to [CWE-20] Improper Input Validation.

Root Cause

The root cause is improper input validation in the resource management endpoints. The application trusts client-supplied resource identifiers or path parameters and fails to enforce that the requesting user owns or is authorized for the referenced resource. This authorization gap between the authenticated session and the resource layer allows cross-tenant file access.

Attack Vector

Exploitation occurs over the network against an authenticated DolphinScheduler session. An attacker with any valid account submits crafted API requests targeting resource file operations belonging to other users or projects. Because DolphinScheduler is frequently deployed in shared, multi-team environments, a single compromised or self-registered account can be sufficient to reach sensitive workflow assets. Refer to the Apache Mailing List Thread and the Openwall OSS Security Discussion for the maintainer disclosure.

Detection Methods for CVE-2024-30188

Indicators of Compromise

Unexpected resource file read or write API calls originating from low-privilege DolphinScheduler accounts
Access log entries showing a single user account touching resource identifiers across multiple projects or tenants
Modifications to workflow resource files without a corresponding audit trail from the resource owner
Outbound data transfers correlated with DolphinScheduler resource download endpoints

Detection Strategies

Enable and review DolphinScheduler audit logs for resource file endpoints, correlating requesting user, target resource, and target owner
Alert when a user account accesses resource identifiers outside the projects the account is a member of
Baseline normal resource access patterns per user and flag statistical outliers in request volume or breadth

Monitoring Recommendations

Forward DolphinScheduler application, API, and web server logs to a centralized analytics platform for cross-source correlation
Monitor filesystem changes on DolphinScheduler master and worker nodes to detect unauthorized writes to the resource directory
Track authentication events and correlate new or dormant account activity with resource file operations

How to Mitigate CVE-2024-30188

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.2.2 or later, which contains the fix for this vulnerability
Inventory all DolphinScheduler accounts and disable unused or shared credentials to reduce the authenticated attack surface
Rotate any secrets, API keys, or credentials stored in DolphinScheduler resource files that may have been exposed
Review resource file access logs for the period preceding the upgrade to identify potential prior abuse

Patch Information

The Apache DolphinScheduler project released version 3.2.2 to remediate CVE-2024-30188. Users on any 3.1.0 through pre-3.2.2 release should upgrade. Patch details and the maintainer announcement are available on the Apache Mailing List Thread.

Workarounds

Restrict network access to the DolphinScheduler web UI and API to trusted internal networks and VPN users only
Enforce least-privilege role assignments so users are members of the minimum set of projects required
Place a reverse proxy or web application firewall in front of DolphinScheduler to filter suspicious resource endpoint requests until patching is complete

bash

# Verify current DolphinScheduler version and plan upgrade to 3.2.2
curl -s http://<dolphinscheduler-host>:12345/dolphinscheduler/actuator/info \
  | jq '.build.version'

# Example: pull the fixed release image
docker pull apache/dolphinscheduler:3.2.2