An authenticated remote code execution vulnerability in the DIRAC distributed computing framework allows attackers to achieve full system compromise, meriting a critical severity rating.

The vulnerability is an Eval Injection (CWE-95) located in the ReqManagerHandler.py function. It allows an authenticated user to supply a crafted grouping attribute that is evaluated as Python code, enabling command execution with the privileges of the DIRAC service.

Successful exploitation grants an attacker the ability to execute arbitrary code on the underlying host, leading to a total compromise of the DIRAC system. This includes the potential exposure of sensitive configuration files, database credentials, security tokens, and proxies, alongside the ability to manipulate audit logs to hide unauthorized activity. Given the CVSS score of 9.9, this vulnerability represents a critical risk to operational integrity and data confidentiality.

Immediate Action: Update the DIRAC installation to version 8.0.79, 9.0.22, or 9.1.10 immediately to incorporate the necessary patch.

Proactive Monitoring: Review system and application logs for unexpected Python execution patterns or unauthorized access to sensitive files such as dirac.cfg.

Compensating Controls: Ensure that access to the DIRAC management interface is strictly limited to authorized personnel via network segmentation or VPN access to reduce the surface area for potential exploitation.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for full system compromise, requires immediate attention. Administrators must prioritize updating to the patched versions listed above to eliminate the injection vector. Given the ability for attackers to alter local log evidence, it is highly recommended to perform a thorough forensic review of affected systems if there is any suspicion of unauthorized access occurring prior to the application of the patch.