## Summary
DIRAC contains an authenticated remote code execution (RCE) vulnerability in RequestManagementSystem/Service/ReqManagerHandler.py where export_getRequestCountersWeb uses eval() on caller-controlled input. An authenticated attacker can execute OS commands as the account running DIRAC services, potentially leading to full compromise.
## Technical Details
- Affected code path: RequestManagementSystem/Service/ReqManagerHandler.py → export_getRequestCountersWeb → RequestManagementSystem/DB/RequestDB.py → getRequestCountersWeb(groupingAttribute, selectDict).
- export_getRequestCountersWeb is callable by any authenticated user and passes parameters directly to the DB layer.
- If groupingAttribute is not one of the recognized values ("Type", "Status"), it is transformed into f"Request.{groupingAttribute}" and then used in eval(groupingAttribute) inside a SQLAlchemy query:
- summaryQuery = session.query(eval(groupingAttribute), func.count(Request.RequestID)).
- The advisory notes that by supplying a crafted dunder attribute expression applicable to the Request object, an attacker can reach Python/OS functionality and trigger command execution in the server context.
- The fix replaces eval()-based resolution with safe ORM attribute resolution using SQLAlchemy inspect() and explicit allowlisting of supported model/column attributes (e.g., Request, Operation, and alias mapping for Status → _Status).
## Affected
- DIRAC versions prior to the patched releases:
- 8.0.79
- 9.0.22
- 9.1.10
- The advisory states the issue exists prior to those versions.
## Impact
- Authenticated RCE on the DIRAC server as the system user running DIRAC services.
- Potential exposure of sensitive configuration and credentials, including:
- dirac.cfg
- database passwords
- stored proxies and tokens
- Ability to alter local log evidence.
## Mitigation
1. Upgrade DIRAC to a fixed version: 8.0.79, 9.0.22, or 9.1.10.
2. If immediate upgrade is not possible, restrict access to the web/API endpoint that reaches export_getRequestCountersWeb to trusted users only (since exploitation requires authentication).
3. Validate that the deployed code includes the RequestDB changes that remove eval() and use safe helpers like _get_column() / _apply_web_filter().
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-95