CVE-2025-62233: Apache DolphinScheduler RPC Vulnerability

CVE-2025-62233 Overview

A deserialization of untrusted data vulnerability has been identified in the RPC module of Apache DolphinScheduler, a widely used distributed workflow scheduling platform. This vulnerability affects versions >= 3.2.0 and < 3.3.1, allowing attackers with network access to Master or Worker nodes to compromise the system through malicious RPC requests.

Critical Impact

Attackers with access to Master or Worker nodes can execute arbitrary code by injecting malicious class types into StandardRpcRequest objects, potentially leading to complete system compromise.

Affected Products

• Apache DolphinScheduler >= 3.2.0 and < 3.3.1
• DolphinScheduler Master nodes with RPC services exposed
• DolphinScheduler Worker nodes with RPC services exposed

Discovery Timeline

• 2026-04-24 - CVE-2025-62233 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-62233

Vulnerability Analysis

This vulnerability stems from insecure deserialization practices in the Apache DolphinScheduler RPC module (CWE-502). The RPC communication mechanism between DolphinScheduler components fails to properly validate and sanitize incoming serialized data before deserialization.

When processing StandardRpcRequest objects, the system accepts and deserializes arbitrary class types without adequate verification. This creates a dangerous attack surface where an attacker can craft malicious serialized payloads containing arbitrary class types that get instantiated during the deserialization process. Upon deserialization, these malicious objects can trigger gadget chains that lead to remote code execution on the target Master or Worker nodes.

The vulnerability requires the attacker to have network access to the RPC endpoints, which are typically exposed on the Master and Worker nodes. While this provides some network segmentation protection, organizations running DolphinScheduler in shared environments or with inadequate network controls face significant risk.

Root Cause

The root cause lies in the insufficient input validation within the DolphinScheduler RPC module's request handling mechanism. The StandardRpcRequest class accepts user-controlled type information that determines which Java class should be instantiated during deserialization. Without proper whitelisting or validation of acceptable class types, attackers can specify arbitrary classes that exist on the classpath, including those that can be chained together to achieve code execution.

Attack Vector

The attack is network-based and requires low-privilege access to reach the RPC endpoints. An attacker exploits this vulnerability by:

1. Gaining network access to a DolphinScheduler Master or Worker node's RPC service
2. Crafting a malicious StandardRpcRequest object containing a malicious class type specification
3. Serializing the payload with embedded gadget chains
4. Sending the malicious RPC request to the target node
5. The server deserializes the payload, instantiating the attacker-controlled classes and executing the embedded code

The vulnerability allows for potential impacts including unauthorized data access, system modification, and service disruption on compromised nodes.

Detection Methods for CVE-2025-62233

Indicators of Compromise

• Unusual RPC traffic patterns to DolphinScheduler Master or Worker nodes from unexpected sources
• Unexpected process spawning or network connections originating from DolphinScheduler Java processes
• Presence of known Java deserialization gadget chain signatures in network traffic
• Anomalous log entries in DolphinScheduler logs indicating deserialization errors or unexpected class loading

Detection Strategies

• Monitor network traffic to DolphinScheduler RPC ports for malformed or suspicious serialized Java objects
• Implement application-level logging to capture deserialization events and class instantiation attempts
• Deploy network intrusion detection rules for common Java deserialization attack patterns
• Review DolphinScheduler application logs for ClassNotFoundException or InvalidClassException errors that may indicate exploitation attempts

Monitoring Recommendations

• Enable verbose logging on DolphinScheduler Master and Worker nodes to capture RPC request details
• Implement network segmentation monitoring to detect unauthorized access attempts to RPC services
• Configure alerts for unusual process behavior or resource consumption on DolphinScheduler hosts
• Monitor for known ysoserial or similar deserialization payload signatures in network traffic

How to Mitigate CVE-2025-62233

Immediate Actions Required

• Upgrade Apache DolphinScheduler to version 3.3.1 or later immediately
• Restrict network access to DolphinScheduler Master and Worker RPC ports using firewall rules
• Implement network segmentation to limit which systems can communicate with DolphinScheduler components
• Review and audit systems for signs of compromise if exposed versions were running

Patch Information

Apache has released version 3.3.1 which addresses this deserialization vulnerability. Users running affected versions (>= 3.2.0 and < 3.3.1) should upgrade immediately. For detailed patch information, refer to the Apache Security Mailing List Update and the OpenWall OSS Security Post.

Workarounds

• Implement strict network access controls limiting RPC port access to only trusted internal systems
• Deploy a Web Application Firewall (WAF) or network filter capable of inspecting and blocking malicious serialized Java objects
• Consider deploying Java Agent-based protection such as RASP (Runtime Application Self-Protection) to detect and block deserialization attacks
• If immediate patching is not possible, consider temporarily disabling external network access to affected DolphinScheduler nodes until the upgrade can be completed

# Example: Restrict RPC port access using iptables
# Allow only trusted internal network (adjust CIDR as needed)
iptables -A INPUT -p tcp --dport 12345 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 12345 -j DROP

# Verify DolphinScheduler version
grep -i version /opt/dolphinscheduler/conf/application.yaml