{"id":"GHSA-7xw9-549r-8jrc","summary":"DIRAC: SQL injection and lack of access control in PilotManager service","details":"### Details\nA number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349\n\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117\n\nThis won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.\n\nFurther to this, the PilotManager access control is only set to \"authenticated\"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118\n\nThis is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/","modified":"2026-07-13T18:46:54.887739752Z","published":"2026-07-13T18:38:13Z","database_specific":{"github_reviewed_at":"2026-07-13T18:38:13Z","nvd_published_at":null,"cwe_ids":["CWE-284","CWE-89"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-7xw9-549r-8jrc"},{"type":"PACKAGE","url":"https://github.com/DIRACGrid/DIRAC"},{"type":"WEB","url":"https://pypi.org/project/DIRAC/8.0.79"},{"type":"WEB","url":"https://pypi.org/project/DIRAC/9.0.22"},{"type":"WEB","url":"https://pypi.org/project/DIRAC/9.1.10"}],"affected":[{"package":{"name":"dirac","ecosystem":"PyPI","purl":"pkg:pypi/dirac"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6"},{"fixed":"8.0.79"}]}],"versions":["7.2.0","7.2.0a32","7.2.0a33","7.2.0a34","7.2.0a35","7.2.0a36","7.2.0a38","7.2.0a39","7.2.1","7.2.10","7.2.12","7.2.13","7.2.14","7.2.15","7.2.16","7.2.19","7.2.2","7.2.20","7.2.21","7.2.22","7.2.23","7.2.24","7.2.25","7.2.26","7.2.27","7.2.28","7.2.3","7.2.30","7.2.31","7.2.32","7.2.33","7.2.34","7.2.35","7.2.36","7.2.37","7.2.38","7.2.39","7.2.4","7.2.40","7.2.41","7.2.42","7.2.43","7.2.44","7.2.45","7.2.46","7.2.47","7.2.48","7.2.49","7.2.5","7.2.50","7.2.51","7.2.52","7.2.6","7.2.7","7.2.8","7.2.9","7.2a29","7.3.0a10","7.3.0a11","7.3.0a13","7.3.0a14","7.3.0a15","7.3.0a16","7.3.0a17","7.3.0a18","7.3.0a19","7.3.0a2","7.3.0a20","7.3.0a21","7.3.0a22","7.3.0a23","7.3.0a24","7.3.0a3","7.3.0a4","7.3.0a5","7.3.0a6","7.3.0a7","7.3.0a8","7.3.0a9","7.3.1","7.3.10","7.3.11","7.3.12","7.3.13","7.3.14","7.3.15","7.3.16","7.3.17","7.3.18","7.3.19","7.3.2","7.3.20","7.3.21","7.3.22","7.3.23","7.3.24","7.3.26","7.3.27","7.3.28","7.3.29","7.3.3","7.3.30","7.3.31","7.3.32","7.3.33","7.3.34","7.3.35","7.3.36","7.3.37","7.3.38","7.3.4","7.3.5","7.3.6","7.3.7","7.3.8","7.3.9","7.4.0a1","8.0.0","8.0.0a1","8.0.0a10","8.0.0a11","8.0.0a12","8.0.0a13","8.0.0a14","8.0.0a15","8.0.0a16","8.0.0a17","8.0.0a18","8.0.0a19","8.0.0a20","8.0.0a21","8.0.0a22","8.0.0a23","8.0.0a24","8.0.0a25","8.0.0a26","8.0.0a27","8.0.0a28","8.0.0a29","8.0.0a5","8.0.0a6","8.0.0a7","8.0.0a8","8.0.0a9","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.4","8.0.40","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.54","8.0.55","8.0.56","8.0.58","8.0.59","8.0.6","8.0.60","8.0.61","8.0.62","8.0.63","8.0.64","8.0.65","8.0.66","8.0.67","8.0.68","8.0.69","8.0.7","8.0.70","8.0.71","8.0.72","8.0.73","8.0.74","8.0.75","8.0.76","8.0.77","8.0.78","8.0.8","8.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"}},{"package":{"name":"dirac","ecosystem":"PyPI","purl":"pkg:pypi/dirac"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0a1"},{"fixed":"9.0.22"}]}],"versions":["8.1.0a1","8.1.0a10","8.1.0a11","8.1.0a12","8.1.0a13","8.1.0a14","8.1.0a15","8.1.0a16","8.1.0a17","8.1.0a18","8.1.0a19","8.1.0a2","8.1.0a20","8.1.0a21","8.1.0a22","8.1.0a23","8.1.0a3","8.1.0a4","8.1.0a5","8.1.0a6","8.1.0a7","8.1.0a8","8.1.0a9","9.0.0","9.0.0a1","9.0.0a10","9.0.0a11","9.0.0a12","9.0.0a13","9.0.0a16","9.0.0a17","9.0.0a18","9.0.0a19","9.0.0a2","9.0.0a20","9.0.0a21","9.0.0a22","9.0.0a23","9.0.0a24","9.0.0a25","9.0.0a26","9.0.0a27","9.0.0a28","9.0.0a29","9.0.0a3","9.0.0a30","9.0.0a31","9.0.0a35","9.0.0a36","9.0.0a37","9.0.0a38","9.0.0a39","9.0.0a4","9.0.0a40","9.0.0a41","9.0.0a42","9.0.0a43","9.0.0a44","9.0.0a45","9.0.0a46","9.0.0a47","9.0.0a48","9.0.0a49","9.0.0a5","9.0.0a50","9.0.0a51","9.0.0a52","9.0.0a53","9.0.0a54","9.0.0a55","9.0.0a56","9.0.0a57","9.0.0a58","9.0.0a59","9.0.0a6","9.0.0a60","9.0.0a61","9.0.0a62","9.0.0a63","9.0.0a64","9.0.0a66","9.0.0a67","9.0.0a68","9.0.0a69","9.0.0a70","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"}},{"package":{"name":"dirac","ecosystem":"PyPI","purl":"pkg:pypi/dirac"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.10"}]}],"versions":["9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"}]}