Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

xuxueli/xxl-job

              master @ 128dd67
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

xxl-job-admin: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure default configurations and missing authentication on RPC/OpenAPI communication protocols allow unauthorized actors to issue job execution commands directly to executors. Enforcing AccessToken validation is critical to securing this channel.

Remote Code Execution: GLUE mode allows executing dynamic, non-bean scripts on executors, introducing massive exposure if unauthorized jobs are triggered. Restricting and disabling GLUE mode globally via configuration toggles is the primary defense.

SSRF: Unrestricted registration of executor addresses can lead to Server-Side Request Forgery if administrative endpoints accept non-standard protocols or malicious schemes during registry lookup.