DataEase JDBC Connection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in DataEase, an open-source business intelligence tool, in versions through 2.10.7. The issue arises from the backend JDBC connection, where authenticated users can execute arbitrary code by crafting a specific JDBC connection string that is processed by the application.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary code on the server where DataEase is running.

Reproduction

To reproduce this vulnerability, an authenticated user must send a request to the DataEase API to validate a datasource configuration. The request must include a JDBC connection string that points to a malicious SQL file hosted on an external server. When the DataEase application processes the JDBC connection, it will execute the code contained in the SQL file, leading to remote code execution.

Remediation

Users are advised to upgrade to DataEase version 2.10.8, where this vulnerability has been patched.