DIRACGrid - CraftedSignal Threat Feed

DIRAC Vulnerable to Remote Code Execution via SQL Injection and Eval in DatasetManager

hello@craftedsignal.io — Mon, 13 Jul 2026 18:41:36 +0000

A critical remote code execution vulnerability, tracked as CVE-2026-61667, has been identified in DIRAC's FileCatalog DatasetManager. This vulnerability allows an authenticated user to execute arbitrary code on the server by combining an SQL injection flaw with the improper use of Python's eval function. Specifically, the checkDataset function in FileCatalogHandler.py passes user-controlled input directly into an SQL query without proper escaping, leading to injection. The malicious SQL injection can manipulate the database query's result, which is subsequently passed to eval in DatasetManager.py, granting an attacker full control over the system. This allows for reading sensitive configuration files, exfiltrating database passwords, and compromising stored proxies and tokens, with the potential to also erase exploit evidence from logs. Patched versions are available for DIRAC 8.0.79, 9.0.22, and 9.1.10.

Attack Chain

An authenticated attacker initiates a request to the DIRAC system, targeting the FileCatalog.checkDataset function.
The attacker crafts a malicious datasets argument containing an SQL injection payload and sends it to the backend database handler.
The __checkDataset function in DatasetManager.py constructs an SQL query using an f-string with the unescaped, user-controlled datasets argument, creating an SQL injection vulnerability.
The injected SQL payload is designed to manipulate the query's result set, inserting arbitrary Python code that the attacker wishes to execute.
The database executes the modified query and returns the manipulated result, which now contains the attacker's arbitrary Python code.
The DatasetManager.py module immediately passes this returned, attacker-controlled result to Python's eval function.
The eval function executes the attacker's arbitrary Python code with the privileges of the DIRAC application.
Remote code execution is achieved, allowing the attacker to perform actions such as reading dirac.cfg, exfiltrating database credentials, and deleting log evidence.

Impact

Successful exploitation of CVE-2026-61667 grants any authenticated user the ability to execute arbitrary commands on the DIRAC server, leading to a complete compromise of the system. Attackers can read sensitive configuration files like dirac.cfg, extract database passwords, and exfiltrate all stored proxies and tokens, thereby gaining extensive access to the environment. Furthermore, if local logging is employed, the attacker can leverage this RCE to remove evidence of their activities, hindering incident response and forensic investigations. The vulnerability affects multiple versions of DIRAC, specifically versions from 6 up to 8.0.79, 8.1.0a1 up to 9.0.22, and 9.1.0 up to 9.1.10.

Recommendation

Immediately update all affected DIRAC installations to a patched version (8.0.79, 9.0.22, or 9.1.10) as listed in the advisory to remediate CVE-2026-61667.
Ensure proper input validation and parameterized queries are implemented for all database interactions within applications to prevent similar SQL injection vulnerabilities.
Implement robust logging and monitoring for critical application functions and ensure logs are forwarded to a secure, immutable log management system to prevent tampering, as attackers can remove evidence if local logging is used.

DIRAC Vulnerable to Remote Code Execution via eval on Untrusted Input in RequestManager

hello@craftedsignal.io — Mon, 13 Jul 2026 17:23:02 +0000

A critical remote code execution vulnerability, tracked as CVE-2026-45579, has been identified in the DIRAC RequestManager component. This flaw stems from the export_getRequestCountersWeb function, which is accessible to any authenticated user and processes untrusted input in its groupingAttribute parameter. This parameter is then prepended with "Request." and directly passed to an eval() call within RequestDB.py if the attribute is unrecognized. This allows an authenticated attacker to inject and execute arbitrary Python code on the DIRAC server. Successful exploitation grants the attacker the ability to run commands as the system user running DIRAC services, enabling full control over the system, including access to sensitive configuration files like dirac.cfg, database passwords, proxies, and tokens. Attackers could also remove their exploit evidence from local RequestManager logs.

Attack Chain

An authenticated attacker accesses the DIRAC web interface or API.
The attacker identifies the export_getRequestCountersWeb function within the RequestManager as an accessible endpoint.
A specially crafted HTTP request is sent to invoke this function, including a malicious groupingAttribute parameter.
The groupingAttribute parameter contains Python code designed for arbitrary command execution (e.g., __import__('os').system('id')) leveraging dunder methods to access system functions.
The ReqManagerHandler.py component passes the untrusted groupingAttribute value to the RequestDB database instance.
Within RequestDB.py, if the provided groupingAttribute is not a recognized grouping string, the system prepends "Request." to it and executes the resulting string via an eval() call.
The eval() function executes the attacker's injected Python code with the privileges of the system user running the DIRAC services.
The attacker achieves remote code execution, enabling actions such as retrieving sensitive dirac.cfg contents, exfiltrating database passwords and tokens, or removing forensic evidence from local RequestManager logs.

Impact

Successful exploitation of CVE-2026-45579 allows any authenticated user to gain arbitrary code execution on the DIRAC server, running commands as the system user. This leads to a full compromise of the DIRAC system, granting the attacker access to highly sensitive information such as the dirac.cfg file, database passwords, and all stored proxies and tokens. The attacker could also utilize this access to manipulate or remove local log files, hindering incident response and forensic analysis efforts. The scope of impact is broad, encompassing data theft, privilege escalation, and complete control over the compromised DIRAC infrastructure.

Recommendation

Deploy the Sigma rule "Detects CVE-2026-45579 Exploitation - DIRAC RequestManager RCE" to your SIEM system to identify exploitation attempts.
Ensure web server access logs are comprehensively collected and stored, providing the necessary cs-uri-stem and cs-uri-query fields for the detection rule.
Immediately apply the patches to DIRAC versions 8.0.79, 9.0.22, or 9.1.10 as recommended in the advisory to mitigate CVE-2026-45579.
Implement rigorous authentication and authorization policies for all users accessing DIRAC systems to reduce the attack surface.