The DIRAC workload management system's pilot wrapper downloads the second stage pilot script (pilot.tar) via HTTPS but explicitly disables SSL certificate validation, mimicking behavior of Python versions prior to 2.7.9. This lack of SSL verification means the pilot code and its checksum file can be intercepted and altered by a man-in-the-middle attacker. Such an attacker could inject arbitrary code executed with the pilot's proxy credentials. The vulnerability requires network-level interception (e.g., DNS or routing manipulation) at a grid site, which may limit exploitation feasibility. Official patches addressing this issue are included in DIRAC versions 8.0.79, 9.0.22, and 9.1.10 and later.

Successful exploitation allows an attacker performing a man-in-the-middle attack on a grid site's network to modify the second stage pilot code, leading to arbitrary code execution with the pilot's proxy credentials. This compromises confidentiality, integrity, and availability of the affected system components. However, the attack complexity is high due to the need for network interception, which likely limits the scope of impact.

Fixed versions of DIRAC are available: 8.0.79, 9.0.22, and 9.1.10 or later. Users should upgrade to these versions to ensure SSL certificate validation is properly enforced when downloading pilot code. Until upgraded, the vulnerability remains exploitable if an attacker can perform a man-in-the-middle attack on the network. No other mitigations are specified.