Can you explain this vulnerability to me?

This vulnerability exists in DataEase, an open-source data visualization and analytics platform, specifically in versions 2.10.20 and below. These versions include a legacy library, velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing a known deserialization gadget chain called InvokerTransformer.

The application also bundles Quartz 2.3.2, which deserializes job data stored in the qrtz_job_details table without any deserialization filters or class allowlists. An authenticated attacker who can write to this Quartz job table—potentially through a previously described SQL injection vulnerability—can replace a scheduled job's data with a malicious payload.

When the Quartz cron trigger executes, it deserializes this malicious payload, which leads to arbitrary command execution as root inside the container, resulting in full remote code execution.

This vulnerability has been fixed in DataEase version 2.10.21.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can have severe impacts because it allows an authenticated attacker to execute arbitrary commands with root privileges inside the container running DataEase.

Such remote code execution can lead to full system compromise, data theft, data manipulation, service disruption, or further attacks within the network.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

The vulnerability can be mitigated by upgrading DataEase to version 2.10.21 or later, which fixes the issue.

Useful 0 Not Useful 0