A remote authenticated attacker can execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0 by exploiting improper connector property sanitization.

This vulnerability is an OS command injection flaw, identified as CWE-78, where an authenticated attacker can manipulate connector property values to execute unauthorized OS commands during OSH script generation.

Successful exploitation of this vulnerability allows an authenticated attacker to achieve remote code execution, granting them the ability to compromise the confidentiality, integrity, and availability of the affected system. With a CVSS score of 8.8, this flaw represents a significant threat to data security and operational stability, as it could lead to full system takeover or unauthorized access to sensitive data processed by the DataStage platform.

Immediate Action: Upgrade DataStage on Cloud Pak for Data to version 5.4 patch 7 or later as specified in the official IBM support documentation.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized modifications to OSH script configurations.

Compensating Controls: Ensure strict access control policies are enforced to limit the number of authenticated users who have permissions to modify connector properties.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this remote code execution vulnerability, organizations should prioritize the application of the vendor-provided patch. Administrators must verify their current version of DataStage on Cloud Pak for Data and perform the upgrade to version 5.4 patch 7 or later immediately to eliminate the risk of command injection.