Conductor OSS runs a stranger's inline JavaScript as root in its default container

GraalVM's polyglot context decides how much of the Java host a guest script can touch. Empirical Security's write-up puts Conductor's context at `HostAccess.ALL` or `allowAllAccess(true)`, the settings under which a guest expression can reach Java reflection and spawn subprocesses ^[4]. Conductor evaluates expressions inside tasks of type INLINE, LAMBDA, DO_WHILE and SWITCH ^[3]. A loop condition therefore reaches the host.

Two defaults decide how far that goes. According to Empirical Security, the Workflow API lacks authentication by default, so the definition registers and the workflow starts without a credential ^[2][3]. The process that evaluates the expression is often root, because that is how the default container image runs it ^[2]. An unauthenticated remote attacker needs network reachability to the API and nothing more ^[14].

Nine minor lines of the 3.x series separate the first affected release from the fixed one ^[16]. A deployment pinned anywhere inside that window is exposed whenever the API is reachable and not fronted by authentication or network controls ^[19].

Split evenly across the two days, Fortinet's block count works out to roughly 650 attempts a day ^[15]. Eighteen days separate Empirical Security's first telemetry hit from the opening of that block window ^[17]. Both figures count attempts, and successful code execution in individual attempts has not been publicly confirmed ^[8]. For the blocked-attempt number to say anything about a given estate, the instance would have to be internet-reachable, running a version in the affected range, and inside the address space those scanners walked ^[19].

Because the attack completes before any login, the identity provider contributes nothing until after the fact, when the question becomes which service credentials the attacker then used ^[12]. The indicators Empirical Security lists sit downstream of the POST: unauthorized workflow definitions, INLINE and similar task types carrying suspicious expressions, external POST requests to the Workflow API, and unexpected child processes or outbound traffic from Conductor ^[11]. On the endpoint that means a shell, Python, or curl running as a child of the Java process ^[13].

The remediation has two halves, and Empirical Security lists both: move to 3.30.2 or later, and restrict the Workflow API to internal networks while denying external registration and execution through authentication, authorization and network controls ^[6]. In my view the second half is the one that survives the next bug in an expression evaluator. An orchestration engine accepts submitted definitions and runs them, and a definition that carries a JavaScript expression is code. Empirical Security says compromise may spread along what the workflow already connects: data, credentials, microservices, and AI agents ^[10].