A high-severity OS command injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated attacker to execute arbitrary commands, leading to full system compromise.

This is an OS command injection vulnerability (CWE-78) occurring due to improper neutralization of special elements within OS commands. It requires the attacker to have authenticated access to the application to trigger the malicious execution.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the host server with the privileges of the application. Given the CVSS score of 8.8, this poses a significant threat to data confidentiality, integrity, and system availability, potentially leading to unauthorized data exfiltration or complete control over the affected environment.

Immediate Action: Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 7 or later as specified in the official IBM support documentation.

Proactive Monitoring: Review application and system access logs for suspicious command-line patterns or unexpected process executions originating from the DataStage service account.

Compensating Controls: Implement strict network segmentation and ensure that the service account running DataStage operates with the principle of least privilege to minimize the impact of potential command execution.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for full system compromise, necessitates immediate attention. Administrators must prioritize the upgrade to version 5.4 patch 7 to eliminate the command injection vector. Failure to remediate this flaw leaves the infrastructure exposed to potential remote code execution by any authenticated user within the environment.