JimuReport Remote Code Execution Vulnerability via H2 JDBC URLs

A remote code execution vulnerability exists in JimuReport versions through 2.1.3. The issue arises because the application does not validate user-controlled H2 JDBC URLs before passing them to the H2 driver. This oversight allows attackers to inject JDBC URLs with specific directives that can execute arbitrary Java code. Exploitation can be achieved by using the 'INIT' or 'CREATE ALIAS' directives to run malicious Java code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where JimuReport is running.

Reproduction

To reproduce this vulnerability, send a POST request to the '/jmreport/testConnection' endpoint with a crafted H2 JDBC URL that includes 'INIT' or 'CREATE ALIAS' directives. The H2 database driver will execute the injected Java code, leading to remote code execution.

Remediation

Users are advised to update to the latest version of JimuReport, as this vulnerability has been fixed in a version that is pending release.