In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.
The Quartz task management function in the system administration module allows invocation of any Java class with a parameterless constructor and its methods accepting a String type parameter — using the reflection mechanism. An attacker can exploit the jakarta.el.ELProcessor class built into the Tomcat server and its eval method, which enables evaluation of EL (Expression Language) expressions. By passing an appropriately crafted expression, the attacker executes arbitrary system commands on the server side.
An attacker with administrative privileges can execute arbitrary commands on the server, leading to complete system takeover — including data theft, backdoor installation, and violation of application integrity and availability.
Apply patches available from the vendor according to the references. As a temporary workaround, it is recommended to restrict access to the Quartz task management functions exclusively to trusted administrators and implement additional network access control (firewall, VPN) to the administration panel.
pig-mesh Pig version 3.8.2 and lower
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HPig4cloud Pig
APPPig4Cloud≤ 3.8.2