Remote Code Execution Vulnerability in DataEase Business Analytics Tool

CVE-2024-55952

What is CVE-2024-55952?

DataEase, an open-source business analytics tool, contains a vulnerability that allows authenticated users to remotely execute code via a backend JDBC connection. The vulnerability stems from insufficient filtering of parameters in the JDBC connection string. Specifically, constructing a connection string in a certain manner can lead to the instantiation of the ClassPathXmlApplicationContext, enabling the execution of arbitrary code. To mitigate any potential risks, users are strongly advised to upgrade to version 1.18.27 or later, as this version includes patches addressing the identified issue. Currently, there are no known workarounds for this vulnerability.

References