Executive brief
DIRAC, a software framework for distributed computing, is vulnerable to a critical security flaw in its FileCatalog component. An authenticated user can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full system compromise. This could allow attackers to steal database passwords, access sensitive configuration files, and export security tokens, while also providing a way to delete logs to hide their activity.
Technical details
A vulnerability exists in the DIRAC FileCatalog DatasetManager where the checkDataset function passes unvalidated arguments to the backend database handler. The __checkDataset function uses Python f-strings to construct SQL queries without proper escaping, leading to SQL injection (CWE-89). Because the results of these queries are subsequently passed to the eval() function (CWE-95), an authenticated attacker can control the input to eval() via the SQL injection, resulting in remote code execution. The exploit allows for full compromise of the DIRAC system, including access to dirac.cfg and stored credentials. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.
Affected products
- DIRACGrid DIRAC >= 6, < 8.0.79
- DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22
- DIRACGrid DIRAC >= 9.1.0, < 9.1.10
Timeline
- 2026-07-13: advisory
- 2026-07-13: disclosed
- 2026-07-13: patched