CVE-2023-37754

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer.

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.

In PowerJob 5.1.0/5.1.1/5.1.2, the detailPlus endpoint in InstanceController.java is vulnerable to SQL injection via the customQuery argument. Remote exploitation is possible. The project was notified but has not responded.

CVE-2023-36106 describes an incorrect access control vulnerability in powerjob version 4.3.2 and earlier, allowing remote attackers to obtain sensitive information via the querying interface using the appId parameter to /container/list.