DataEase SQL Injection Vulnerability in CalciteProvider Component

A SQL injection vulnerability has been identified in DataEase versions prior to 2.10.21. The issue arises in the '/datasource/getTableField' endpoint, where the 'tableName' parameter is directly inserted into SQL query strings without proper sanitization or parameterization. This flaw allows authenticated attackers to execute arbitrary SQL commands, potentially leading to the extraction of sensitive database information. The vulnerability can be exploited by registering an API datasource with a malicious table name, which bypasses existing validation checks.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, with the potential to leak sensitive information from the database.

Reproduction

To reproduce this vulnerability, register an API datasource and include a malicious payload as the table name. Once the datasource is created, the injected table name will be validated and can be used to trigger the SQL injection via the '/datasource/getTableField' endpoint.

Remediation

Users are advised to upgrade to DataEase version 2.10.21, where this vulnerability has been fixed.