Apache DolphinScheduler Deserialization of Untrusted Data Vulnerability in RPC Module

A deserialization vulnerability allowing the injection of malicious class types has been identified in the RPC module of Apache DolphinScheduler. This issue affects versions 3.2.0 prior to 3.3.1. Attackers with access to Master or Worker nodes can exploit this vulnerability by creating a StandardRpcRequest, injecting a harmful class type, and sending the modified RPC requests to the affected nodes.

Impact

Exploitation of this vulnerability could lead to remote code execution on the Master or Worker nodes.

Remediation

Users are advised to upgrade to Apache DolphinScheduler version 3.3.1, which addresses this vulnerability.