{"id":"GHSA-7xw9-549r-8jrc","title":"DIRAC: SQL injection and lack of access control in PilotManager service","summary":"DIRAC: SQL injection and lack of access control in PilotManager service","severity":"high","cvss":8.5,"cwe":["CWE-89","CWE-284"],"vendor":"DIRAC","product":"DIRAC","ecosystem":"pip","affected":["DIRAC >= 6, < 8.0.79","DIRAC >= 8.1.0a1, < 9.0.22","DIRAC >= 9.1.0, < 9.1.10"],"patched":["DIRAC 8.0.79","DIRAC 9.0.22","DIRAC 9.1.10"],"published":"2026-07-13","updated":"2026-07-13","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7xw9-549r-8jrc","references":[{"url":"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-7xw9-549r-8jrc"},{"url":"https://pypi.org/project/DIRAC/8.0.79"},{"url":"https://pypi.org/project/DIRAC/9.0.22"},{"url":"https://pypi.org/project/DIRAC/9.1.10"},{"url":"https://github.com/advisories/GHSA-7xw9-549r-8jrc"}],"tags":["ghsa","pip"],"ingestedAt":"2026-07-13T19:28:40.491Z","slug":"GHSA-7xw9-549r-8jrc","body":"## Overview\n\n### Details\nA number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349\n\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117\n\nThis won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.\n\nFurther to this, the PilotManager access control is only set to \"authenticated\"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118\n\nThis is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/\n\n## Affected packages\n\n- `DIRAC >= 6, < 8.0.79`\n- `DIRAC >= 8.1.0a1, < 9.0.22`\n- `DIRAC >= 9.1.0, < 9.1.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `DIRAC 8.0.79`\n- `DIRAC 9.0.22`\n- `DIRAC 9.1.10`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}