A remote authenticated attacker can execute arbitrary commands on IBM DataStage on Cloud Pak for Data version 5.4.0.0 due to a critical OS command injection vulnerability.

This vulnerability is classified as CWE-78, which involves the improper neutralization of special elements used in an OS command. It allows an authenticated attacker to inject and execute system-level commands, effectively bypassing intended application restrictions.

The ability for an authenticated user to perform OS command injection poses a severe risk to the confidentiality, integrity, and availability of the entire host environment. With a CVSS score of 8.8, this flaw could lead to full system compromise, unauthorized data exfiltration, or the deployment of persistent malicious payloads, resulting in significant operational downtime and potential data breaches.

Immediate Action: Upgrade to DataStage on Cloud Pak for Data version 5.4 patch 7 or later as specified in the official IBM support documentation.

Proactive Monitoring: Review system and application access logs for unusual command execution patterns or unauthorized attempts to access system-level binaries by service accounts.

Compensating Controls: Implement strict network segmentation and apply Web Application Firewall (WAF) rules that filter for suspicious OS command syntax in HTTP requests to the DataStage interface.

Public Exploit Available: No

Given the high severity of this command injection vulnerability, organizations must prioritize the application of the vendor-provided patch. Administrators should verify their current deployment version immediately and schedule the upgrade to 5.4 patch 7 or later during the next maintenance window to prevent potential unauthorized system-level access.