Read the docs
TI-2026-67058 Aliases GHSA-7xw9-549r-8jrc

DIRAC: SQL injection and lack of access control in PilotManager service

Priority LOW 38CWE-284Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass, SQL injection
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-284 and CWE-89.

Summary

### Details A number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349 https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117 This won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries. Further to this, the PilotManager access control is only set to "authenticated"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118 This is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions. ### Patched versions: https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/

Why it matters now

Fix Fixed DIRAC (PyPI): 8.0.79, 9.0.22, 9.1.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DIRAC (PyPI)6 to before 8.0.798.0.79Patch availableGHSA-7xw9-549r-8jrc
—DIRAC (PyPI)8.1.0a1 to before 9.0.229.0.22Patch availableGHSA-7xw9-549r-8jrc
—DIRAC (PyPI)9.1.0 to before 9.1.109.1.10Patch availableGHSA-7xw9-549r-8jrc
  • DIRAC (PyPI) Vendor— Affected 6 to before 8.0.79 Fixed in 8.0.79 Patch available GHSA-7xw9-549r-8jrc
  • DIRAC (PyPI) Vendor— Affected 8.1.0a1 to before 9.0.22 Fixed in 9.0.22 Patch available GHSA-7xw9-549r-8jrc
  • DIRAC (PyPI) Vendor— Affected 9.1.0 to before 9.1.10 Fixed in 9.1.10 Patch available GHSA-7xw9-549r-8jrc

Remediation

  • Fix · GHSA-7xw9-549r-8jrc DIRAC (PyPI) Fixed in 8.0.79 Advisory →
  • Fix · GHSA-7xw9-549r-8jrc DIRAC (PyPI) Fixed in 9.0.22 Advisory →
  • Fix · GHSA-7xw9-549r-8jrc DIRAC (PyPI) Fixed in 9.1.10 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7xw9-549r-8jrc

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences