Merge pull request #592 from rundeck/RUN-3540

RUN-3540: Security Fix: Disable external extension loading by default.

Author: fdevans

.gitignore

@@ -2,6 +2,8 @@
 /.idea
 /build
 */build
+/bin
+*/bin
 */out
 *.ipr
 *.iml

CHANGELOG.md

@@ -1,3 +1,8 @@
+## Unreleased
+
+* **Security Fix**: External extension directory loading is now disabled by default to prevent arbitrary code execution vulnerability. To enable extension loading from external directories, set environment variable `RD_EXT_DISABLED=false`. (Addresses RUN-3540)
+
+
 ## 2.0.9
 
 * fix: NPE if system info does not return all data

dockers/install/upgrade-rpm/Dockerfile

@@ -7,6 +7,7 @@ RUN which java
 RUN curl https://raw.githubusercontent.com/rundeck/packaging/main/scripts/rpm-setup.sh 2> /dev/null | bash -s rundeck
 RUN sed -i.bak s/gpgcheck=0/gpgcheck=1/ /etc/yum.repos.d/rundeck.repo
 RUN rpm --import https://raw.githubusercontent.com/rundeck/packaging/main/pubring.gpg
+RUN rpm --import https://raw.githubusercontent.com/rundeck/packaging/main/pubring20250228.gpg
 RUN rpm --import https://docs.rundeck.com/keys/BUILD-GPG-KEY-20230105.key
 
 RUN yum -y install rundeck-cli

packaging

@@ -196,7 +196,7 @@ private static ConfigSource buildConfig() {
     }
 
     private static void loadExtensionJars(ConfigSource config) {
-        if (config.getBool(RD_EXT_DISABLED, false)) {
+        if (config.getBool(RD_EXT_DISABLED, true)) {
             return;
         }
         String rd_ext_dir = config.get(RD_EXT_DIR);