CVE-2024-47074: Dataease PostgreSQL JDBC RCE Vulnerability

CVE-2024-47074 Overview

CVE-2024-47074 is a critical insecure deserialization vulnerability in DataEase, an open source data visualization analysis tool. The vulnerability exists in the PostgreSQL data source configuration functionality, where the PgConfiguration class fails to properly filter JDBC connection parameters. This allows attackers to inject malicious parameters into the JDBC URL, connect to a malicious PostgreSQL server, and trigger a deserialization attack that can lead to remote code execution and complete server compromise.

Critical Impact

Unauthenticated attackers can achieve remote code execution by exploiting the PostgreSQL JDBC deserialization vulnerability, potentially gaining full control of the DataEase server and underlying infrastructure.

Affected Products

• DataEase versions prior to v1.18.25
• DataEase data visualization analysis tool with PostgreSQL data source functionality

Discovery Timeline

• 2024-10-11 - CVE-2024-47074 published to NVD
• 2024-11-12 - Last updated in NVD database

Technical Details for CVE-2024-47074

Vulnerability Analysis

The vulnerability resides in the JdbcProvider.java file located at backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java. The PgConfiguration class processes PostgreSQL JDBC connection strings without implementing proper input validation or parameter filtering. When users configure a PostgreSQL data source, they can specify custom JDBC connection parameters that are directly concatenated into the connection URL without sanitization.

This design flaw enables attackers to inject arbitrary JDBC parameters that can be leveraged to connect to a malicious PostgreSQL server under their control. By crafting specific JDBC parameters that trigger deserialization behavior in the PostgreSQL JDBC driver, an attacker can exploit known deserialization gadget chains to achieve arbitrary command execution on the DataEase server.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The PgConfiguration class directly concatenates user-supplied input into JDBC URLs without any filtering or validation of potentially dangerous parameters. This allows attackers to inject parameters that trigger unsafe deserialization behavior when the JDBC driver processes the connection to a malicious server.

Attack Vector

The attack follows these steps:

1. An attacker with access to the DataEase data source configuration interface creates or modifies a PostgreSQL data source
2. The attacker injects malicious JDBC parameters into the connection configuration that instruct the driver to connect to an attacker-controlled PostgreSQL server
3. When DataEase attempts to establish the connection, the malicious server responds with serialized Java objects containing exploit payloads
4. The PostgreSQL JDBC driver deserializes these objects, triggering gadget chains that execute arbitrary system commands
5. The attacker gains remote code execution with the privileges of the DataEase application

The attack requires network access to the DataEase application and the ability to configure data sources. For technical details on the exploitation mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2024-47074

Indicators of Compromise

• Unusual PostgreSQL data source configurations pointing to external or unexpected IP addresses
• Network connections from the DataEase server to non-standard PostgreSQL ports or unknown hosts
• Unexpected process spawning from the DataEase Java process
• Suspicious modifications to data source configurations in DataEase audit logs

Detection Strategies

• Monitor data source configuration changes for PostgreSQL connections with unusual JDBC parameters
• Implement network segmentation to detect outbound connections to unauthorized database servers
• Deploy endpoint detection to identify deserialization exploit patterns and suspicious Java process behavior
• Review DataEase application logs for failed or unusual database connection attempts

Monitoring Recommendations

• Enable verbose logging for DataEase data source operations to capture configuration changes
• Implement network monitoring to alert on connections to unknown PostgreSQL servers
• Deploy file integrity monitoring on the DataEase installation directory
• Configure SIEM rules to correlate unusual database connection patterns with potential exploitation attempts

How to Mitigate CVE-2024-47074

Immediate Actions Required

• Upgrade DataEase to version v1.18.25 or later immediately
• Audit all existing PostgreSQL data source configurations for suspicious or unauthorized parameters
• Restrict network access from DataEase servers to only authorized database hosts
• Review and limit user permissions for data source configuration within DataEase

Patch Information

The DataEase development team has addressed this vulnerability in version v1.18.25. The fix implements proper filtering and validation of JDBC connection parameters in the PgConfiguration class to prevent injection of dangerous parameters. The patch is available at the GitHub commit.

Organizations should verify the upgrade by checking the DataEase version after deployment and reviewing the security advisory at GHSA-jgg7-w629-wcpc.

Workarounds

• Implement network-level restrictions to prevent DataEase from connecting to unauthorized PostgreSQL servers
• Disable or remove the PostgreSQL data source capability if not required for business operations
• Deploy a web application firewall (WAF) to inspect and block suspicious data source configuration requests
• Apply principle of least privilege by limiting which users can configure data sources in DataEase

# Network restriction example - limit outbound PostgreSQL connections
# Add firewall rules to restrict DataEase server from connecting to unauthorized hosts
iptables -A OUTPUT -p tcp --dport 5432 -d <authorized_pg_server_ip> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 5432 -j DROP