DataEase H2 JDBC Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in DataEase versions prior to 2.10.12. This issue arises from a JDBC URL parsing flaw that allows for the execution of arbitrary H2 database commands. When a crafted JDBC URL is processed, it bypasses H2's built-in filtering, exposing the application to potential code execution risks.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where DataEase is running.

Reproduction

To reproduce this vulnerability, send a POST request to the '/de2api/datasource/validate' endpoint with a 'jdbcUrl' parameter that includes a crafted H2 JDBC URL. The URL should be constructed to bypass H2's filtering and include commands that could be executed by the H2 database engine. The 'driver' parameter must be set to 'org.h2.Driver' to specify the H2 JDBC driver for the connection.

Remediation

Users are advised to upgrade to DataEase version 2.10.12 or later, where this vulnerability has been fixed.