Skip to content
Threat Feed
Subscribe
critical advisory

DIRAC Vulnerable to Remote Code Execution via SQL Injection and Eval in DatasetManager

An authenticated user can achieve remote code execution in DIRAC's FileCatalog DatasetManager due to an SQL injection vulnerability (CVE-2026-61667) that allows manipulation of query results passed to an `eval` function, leading to full system compromise.

A critical remote code execution vulnerability, tracked as CVE-2026-61667, has been identified in DIRAC's FileCatalog DatasetManager. This vulnerability allows an authenticated user to execute arbitrary code on the server by combining an SQL injection flaw with the improper use of Python's eval function. Specifically, the checkDataset function in FileCatalogHandler.py passes user-controlled input directly into an SQL query without proper escaping, leading to injection. The malicious SQL injection can manipulate the database query's result, which is subsequently passed to eval in DatasetManager.py, granting an attacker full control over the system. This allows for reading sensitive configuration files, exfiltrating database passwords, and compromising stored proxies and tokens, with the potential to also erase exploit evidence from logs. Patched versions are available for DIRAC 8.0.79, 9.0.22, and 9.1.10.

Attack Chain

  1. An authenticated attacker initiates a request to the DIRAC system, targeting the FileCatalog.checkDataset function.
  2. The attacker crafts a malicious datasets argument containing an SQL injection payload and sends it to the backend database handler.
  3. The __checkDataset function in DatasetManager.py constructs an SQL query using an f-string with the unescaped, user-controlled datasets argument, creating an SQL injection vulnerability.
  4. The injected SQL payload is designed to manipulate the query's result set, inserting arbitrary Python code that the attacker wishes to execute.
  5. The database executes the modified query and returns the manipulated result, which now contains the attacker's arbitrary Python code.
  6. The DatasetManager.py module immediately passes this returned, attacker-controlled result to Python's eval function.
  7. The eval function executes the attacker's arbitrary Python code with the privileges of the DIRAC application.
  8. Remote code execution is achieved, allowing the attacker to perform actions such as reading dirac.cfg, exfiltrating database credentials, and deleting log evidence.

Impact

Successful exploitation of CVE-2026-61667 grants any authenticated user the ability to execute arbitrary commands on the DIRAC server, leading to a complete compromise of the system. Attackers can read sensitive configuration files like dirac.cfg, extract database passwords, and exfiltrate all stored proxies and tokens, thereby gaining extensive access to the environment. Furthermore, if local logging is employed, the attacker can leverage this RCE to remove evidence of their activities, hindering incident response and forensic investigations. The vulnerability affects multiple versions of DIRAC, specifically versions from 6 up to 8.0.79, 8.1.0a1 up to 9.0.22, and 9.1.0 up to 9.1.10.

Recommendation

  • Immediately update all affected DIRAC installations to a patched version (8.0.79, 9.0.22, or 9.1.10) as listed in the advisory to remediate CVE-2026-61667.
  • Ensure proper input validation and parameterized queries are implemented for all database interactions within applications to prevent similar SQL injection vulnerabilities.
  • Implement robust logging and monitoring for critical application functions and ensure logs are forwarded to a secure, immutable log management system to prevent tampering, as attackers can remove evidence if local logging is used.