Dataease JNDI Injection Vulnerability in Oracle JDBC Connections

A JNDI injection vulnerability has been identified in Dataease versions 2.10.14 and prior. The issue arises because the application did not properly sanitize parameters when establishing JDBC connections to Oracle databases. This oversight allows for the injection of malicious JNDI references, which could be exploited under certain conditions.

Impact

Exploitation of this vulnerability allows for JNDI injection, where an attacker can manipulate JNDI lookups to potentially execute arbitrary code or access sensitive information.

Reproduction

To reproduce this vulnerability, create a JDBC connection to an Oracle database using a URL that includes a malicious LDAP reference. If the connection is established and the LDAP server receives the request, the vulnerability has been successfully exploited.

Remediation

Users are advised to upgrade to Dataease version 2.10.15, where this vulnerability has been fixed.