CVE-2024-42681: 
Java vulnerability analysis and mitigation

An Insecure Permissions vulnerability was discovered in xxl-job version 2.4.1, identified as CVE-2024-42681. The vulnerability allows remote attackers to execute arbitrary code through the Sub-Task ID component. This security issue was initially reported on August 15, 2024, and received updates from both NIST and CISA by August 19, 2024 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized under CWE-276 (Incorrect Default Permissions) and CWE-277 (Insecure Inherited Permissions). The vulnerability specifically relates to permission control issues in the Sub-Task ID component of xxl-job (NVD).

The vulnerability allows ordinary users to bypass permission controls and execute tasks on unauthorized executors. Users can indirectly execute tasks on executors they are not assigned to by manipulating sub-task IDs, effectively circumventing the intended access controls (GitHub Issue).

The vulnerability can be exploited by creating a task on an authorized executor and using the sub-task ID from an unauthorized executor. This allows ordinary users to execute tasks on executors they don't have permission to access. The attack requires low complexity and only low privileges to execute (GitHub Issue).