Xuxueli XXL-Job OS Command Injection Vulnerability in SampleXxlJob Handler

A critical OS command injection vulnerability has been identified in Xuxueli XXL-Job versions through 3.1.1. The issue arises in the 'commandJobHandler' function within 'SampleXxlJob.java', where user-controlled parameters are accepted without proper validation or escaping. This lack of security measures allows remote attackers to execute arbitrary system commands.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the server's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to the '/run' endpoint with the 'executorHandler' parameter set to 'commandJobHandler'. Include a command to be executed in the 'executorParams' field. The request must also include a valid 'XXL-JOB-ACCESS-TOKEN'.