Executive brief
PowerJob, an enterprise job scheduling middleware, contains a security flaw in its instance detail endpoint. An unauthenticated attacker can exploit this to execute unauthorized database commands and potentially take full control of the server. This could lead to the theft of sensitive data, disruption of scheduled business tasks, or a complete system compromise.
Technical details
A vulnerability exists in PowerJob versions 5.1.0 through 5.1.2 due to a combination of missing authorization and insufficient input validation. The 'detailPlus' endpoint in InstanceController.java lacks the @ApiPermission annotation, allowing unauthenticated access. Furthermore, the 'customQuery' parameter is directly concatenated into H2 SQL queries without sufficient blacklisting of dangerous keywords like 'RUNSCRIPT' or 'CALL'. An attacker can leverage this SQL injection to execute H2-specific commands, leading to remote code execution (RCE). A pull request (#1166) has been proposed to add the missing permission checks and expand the keyword blacklist, but a formal release may still be pending.
Affected products
- PowerJob PowerJob 5.1.0, 5.1.1, 5.1.2
Timeline
- 2026-03-24: disclosed: Issue and Pull Request submitted to GitHub repository
- 2026-04-07: advisory: Initial advisory published