DIRAC vulnerabilities

DIRAC's PilotWrapper.py downloads the second-stage pilot.tar archive and its reference checksum without TLS certificate verification, using ssl._create_unverified_context. An attacker able to redirect or intercept network traffic (e.g., via DNS or routing manipulation) can substitute both the pilot code and its checksum, leading to arbitrary code execution with access to pilot proxy credentials. Fixed in versions 8.0.79, 9.0.22, and 9.1.10.

In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the checkDataset function in FileCatalogHandler.py forwards an authenticated caller-controlled datasets value to __checkDataset in DatasetManager.py, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution.

In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the export_getRequestCountersWeb function in ReqManagerHandler.py passes an authenticated caller-controlled groupingAttribute to getRequestCountersWeb in RequestDB.py. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands.