A critical Cross Site Request Forgery vulnerability in xxl-job-admin version 3.0.0 enables unauthorized modification of sensitive system scripts.

The application fails to implement proper CSRF token validation on the Glue IDE shell script modification endpoint, allowing an unauthenticated attacker to execute unauthorized actions via a web request.

With a CVSS score of 9.1, this vulnerability is critical. Unauthorized modification of shell scripts can lead to arbitrary code execution, resulting in full system compromise, data theft, or complete disruption of job automation processes.

Immediate Action: Review the vendor advisory for official patch releases. If a patch is unavailable, restrict network access to the admin interface to trusted management subnets only.

Proactive Monitoring: Audit logs for unauthorized requests to the Glue IDE script modification endpoints and monitor for unexpected changes to job configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming requests and block those lacking valid CSRF tokens or originating from untrusted sources.

Public Exploit Available: Yes (a proof of concept is available via a public GitHub repository).

This vulnerability poses a severe risk to the integrity of the job management infrastructure. It is imperative that administrators restrict access to the administration interface immediately while awaiting a vendor-supplied patch.