A user who has WRITE authorization to an Access Point (i.e. is allowed to place jobs) can execute arbitrary code as the 'condor' user on that Access Point. This can allow the user to issue ADMINISTRATOR-level commands, edit any attribute in any job ClassAd, and enable the impersonation of other user accounts on the AP. The user can also obtain an IDToken identifying them as the 'condor' user, which can be used at any other machines that have the same IDToken signing key(s) as the vulnerable Access Point.

An attacker needs to have WRITE authorization to an Access Point (i.e. the ability to place jobs).

An attacker needs to write custom tools.

This attack allows a user to execute code as the 'condor' user on the Access Point. This includes running administrative commands (hold/remove jobs, submit jobs as other users, turn daemons off, etc). The attacker can also request an IDToken for the 'condor' user, which may be usable on other machines if the same IDToken signing keys are present on those machines.

Upgrading your HTCondor Access Points to version 24.0.24, 24.12.24, 25.0.14 or 25.13.3 fully addresses this vulnerability.

If upgrading isn't possible, you can mitigate this issue by disabling job late materialization. You can add this line to the configuration file(s) on the Access Point(s) and then issue a condor_reconfig:

SCHEDD_ALLOW_LATE_MATERIALIZE = False

Note that with this setting, when a user submits a set of jobs, all jobs will be materialized immediately. This may result in significantly longer submit times and larger memory usage by the condor_schedd daemon.

Embargoed until future notice.