DataEase Redshift JDBC Connection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in DataEase versions through 2.10.8. This issue allows authenticated users to execute arbitrary code via the backend JDBC connection to Redshift. The vulnerability arises from a lack of proper input validation, enabling the execution of malicious payloads embedded in the JDBC URL.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary code on the server where DataEase is running.

Reproduction

To reproduce this vulnerability, first upload a malicious XML file containing a payload designed to be executed, such as a ProcessBuilder command, to a location accessible by the DataEase application. Then, create a JDBC connection to a Redshift database, including the URL of the malicious XML file in the 'socketFactoryArg' parameter. When the connection is established, the application will download and execute the XML file, triggering the remote code execution.

Remediation

Users are advised to upgrade to DataEase version 2.10.9, where this vulnerability has been patched.