A remote authenticated attacker can execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0, posing a significant risk of full system compromise.

This vulnerability is an OS command injection flaw (CWE-78) occurring due to improper neutralization of special elements within the application. A remote attacker with authenticated access can leverage this defect to execute unauthorized operating system commands with the privileges of the application service.

The ability to execute arbitrary code on the server grants an attacker complete control over the affected DataStage instance. This level of access permits the exfiltration of sensitive data, modification of critical business processes, and potential lateral movement into the broader Cloud Pak for Data environment. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent total system compromise.

Immediate Action: Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 7 or later as outlined in the official IBM support documentation.

Proactive Monitoring: Review system access logs for unusual command execution patterns or unauthorized shell activity originating from the service account running DataStage.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact if the application is compromised, and ensure that a Web Application Firewall is configured to detect and block common command injection strings.

Public Exploit Available: No

The severity of this vulnerability, combined with the potential for total system compromise, necessitates an immediate upgrade to the patched version. Security administrators should prioritize the deployment of patch 7 for DataStage on Cloud Pak for Data 5.4.0.0 to eliminate the command injection vector and prevent potential unauthorized code execution.