DataEase Arbitrary File Read Vulnerability via JDBC Connection

A vulnerability allowing authenticated users to read and deserialize arbitrary files has been identified in DataEase versions through 2.10.5. This issue arises from the background JDBC connection, which does not properly verify file read requests. The vulnerability has been patched in version 2.10.6.

Impact

Exploitation of this vulnerability allows for arbitrary file read and deserialization on the server where DataEase is running.

Reproduction

To reproduce this vulnerability, an authenticated user can upload a JDBC datasource configuration that includes illegal parameters, such as 'autoDeserialize' or 'allowLoadLocalInfileInPath'. After the datasource is saved, the application will read and deserialize the specified files on the server. It is recommended to include 'maxAllowedPacket' in the illegalParameters to facilitate the exploitation.

Remediation

Users are advised to upgrade to DataEase version 2.10.6.