CVE-2024-30188: File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache…

PriorityP260high8.1CVSS 3.1

AVNACLPRLUINSUCHIHAN

EXPLOIT

EPSS

5.99%

92.5th percentile

File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	dolphinscheduler	>= 3.1.0 < 3.2.2	3.2.2
apache_software_foundation	apache_dolphinscheduler	>= 3.1.0 < 3.2.2	3.2.2

Detection & IOCsextracted from sources · hover to see the quote

url/dolphinscheduler/resources/download?fullName=file:///etc/passwd↗

path/dolphinscheduler/resources/download↗

cookiesessionId↗

→Detect exploitation attempts by monitoring GET requests to /dolphinscheduler/resources/download with a 'fullName' parameter containing 'file://' URI scheme, indicating local file read attempts. ↗
→Successful exploitation can be confirmed if the HTTP 200 response body matches the regex 'root:.*:0:0:' (passwd file content) with Content-Type application/json. ↗
→Attackers first authenticate via POST /dolphinscheduler/login to obtain a sessionId, then use it in the download endpoint. Monitor for this two-step pattern from the same source IP. ↗
→Use Shodan/FOFA/Google dorks to identify exposed DolphinScheduler instances: http.title:"dolphinscheduler", title="dolphinscheduler", intitle:"dolphinscheduler". ↗
→Affected versions are Apache DolphinScheduler >= 3.1.0 and < 3.2.2. Verify installed version to prioritize patching. ↗

·Exploitation requires valid credentials (authenticated users only). Unauthenticated access to the download endpoint alone is insufficient; a valid sessionId must first be obtained via the login endpoint. ↗
·The vulnerability allows both file read AND write operations on arbitrary resource files, not just read — scope of impact extends beyond LFI to potential file tampering. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.