GHSA-7XW9-549R-8JRC: Unrelated PushJobAgent CPU Config Change Is a Bandaid for PilotManager Issues

Vulnerability

GHSA-7XW9-549R-8JRC describes two security classes in DIRAC PilotManager: blind SQL injection reachable by an authenticated low-privilege user, and improper access control permitting unauthorized administrative actions. The summary attributes the issues to unsanitized input formatting and overly permissive default access controls. A complete remediation would therefore be expected to change one or both of: SQL construction paths to eliminate attacker-controlled interpolation, and authorization policy enforcement to restrict privileged PilotManager operations.

The supplied code diff, however, is confined to src/DIRAC/WorkloadManagementSystem/Agent/PushJobAgent.py and its tests. The changes add per-queue CPU metadata propagation into dirac.cfg and command-line arguments for dirac-jobexec. No evidence is shown of modifications to PilotManager, database query APIs, escaping/parameterization logic, or access-control checks.

Patch

The referenced commit 1738e7c6d2f31d26f1364255d9d2e87b4896c922 introduces a helper that appends /LocalSite/CPUTimeLeft and /LocalSite/CPUNormalizationFactor to a generated CFG file, and threads a cpuInfo structure through job submission paths. The tests validate that the helper preserves existing CFG content and that the generated dirac.cfg contains the injected values.

def _appendLocalSiteCFG(self, cfgFilename, cpuInfo):
    cfg = CFG()
    cfg.loadFromFile(str(cfgFilename))
    if not cfg.isSection("LocalSite"):
        cfg.createNewSection("LocalSite")
    cfg.setOption("/LocalSite/CPUTimeLeft", str(cpuInfo["CPUTimeLeft"]))
    cfg.setOption("/LocalSite/CPUNormalizationFactor", str(cpuInfo["CPUNormalizationFactor"]))
    with open(cfgFilename, "w") as fd:
        fd.write(str(cfg))

That behavior is operationally meaningful for workload execution, but it is not security-relevant to the advisory as summarized. There is no shown replacement of string-formatted SQL with parameterized queries, no validation layer for attacker-controlled fields, and no tightening of default authorization rules. The official advisory reference is here, and an external summary is available at cvereports.com.

Review

Pros

• The patch is internally coherent for its apparent functional goal: propagating per-queue CPU accounting values to payload execution.
• It adds focused tests for both the helper method and an end-to-end submission path, improving regression coverage for the new behavior.
• The helper preserves existing CFG sections rather than clobbering the file, which reduces operational risk in the modified code path.

Cons

• The patch does not appear to touch the vulnerable subsystem identified in the advisory summary: PilotManager.
• No SQL-related remediation is visible: no prepared statements, no query parameterization, no escaping hardening, and no removal of unsafe formatting.
• No access-control remediation is visible: no privilege checks, no role validation, no narrowing of default permissions, and no administrative action gating.
• The added command-line argument construction uses string interpolation, which is unrelated to the disclosed SQLi but reinforces that the patch is not focused on the advisory's root causes.
• Because the diff is orthogonal to the disclosed issue classes, shipping it as the security fix would leave exploitability unchanged based on the provided evidence.

Verdict

Bandaid.

On the supplied evidence, this commit is not a substantive fix for GHSA-7XW9-549R-8JRC. The advisory describes SQL injection and improper access control in PilotManager, while the patch modifies PushJobAgent CPU metadata handling and test coverage around CFG generation. Unless additional, unshown changes exist in the actual release, this patch does not address the stated root causes and should not be accepted as sufficient security remediation. Engineers should look for companion changes in PilotManager and database/authorization layers before considering the issue fixed.