CVE-2024-49194: Databricks JDBC Driver RCE Vulnerability

CVE-2024-49194 Overview

CVE-2024-49194 is a Command Injection vulnerability affecting the Databricks JDBC Driver version 2.x before 2.6.40. The vulnerability enables remote code execution (RCE) by exploiting improper handling of the krbJAASFile parameter in JDBC connection URLs. An attacker can craft a malicious JDBC URL that triggers JNDI injection, potentially achieving arbitrary code execution within the context of the driver when a victim uses the compromised connection string.

Critical Impact

Successful exploitation allows remote code execution through JNDI injection, enabling attackers to execute arbitrary code in the context of the JDBC driver when victims connect using malicious JDBC URLs.

Affected Products

• Databricks JDBC Driver 2.x versions prior to 2.6.40

Discovery Timeline

• 2024-12-17 - CVE-2024-49194 published to NVD
• 2025-07-02 - Last updated in NVD database

Technical Details for CVE-2024-49194

Vulnerability Analysis

This vulnerability stems from improper input validation in the Databricks JDBC Driver when processing the krbJAASFile parameter within JDBC connection URLs. The driver fails to properly sanitize or restrict the values that can be passed through this Kerberos-related configuration parameter, creating an injection point for JNDI (Java Naming and Directory Interface) lookups.

JNDI injection vulnerabilities are particularly dangerous in Java environments because they can be leveraged to load and execute arbitrary classes from remote locations. When a victim application or user attempts to establish a database connection using a crafted JDBC URL, the malicious krbJAASFile parameter value triggers a JNDI lookup that can retrieve and instantiate malicious objects from an attacker-controlled server.

The attack requires user interaction—specifically, a victim must be tricked into using the attacker-crafted connection URL. This could occur through social engineering, phishing, or by compromising configuration files or systems that store JDBC connection strings.

Root Cause

The root cause is improper handling and insufficient validation of the krbJAASFile parameter in JDBC connection URLs. The driver accepts and processes JNDI lookup references within this parameter without adequate sanitization, allowing attackers to inject malicious JNDI URIs that can point to attacker-controlled resources containing weaponized Java classes.

Attack Vector

The attack is network-based and requires low privileges but does require user interaction. An attacker constructs a malicious JDBC connection URL containing a specially crafted krbJAASFile parameter value that includes a JNDI lookup reference (such as ldap:// or rmi:// URIs). When a victim uses this connection string to establish a database connection, the JDBC driver processes the malicious parameter, triggering a JNDI lookup to the attacker's server. The attacker's server then serves a malicious Java object that gets deserialized and executed on the victim's system.

The vulnerability can be exploited through scenarios where attackers can influence JDBC connection strings, such as through:

• Social engineering to convince users to use malicious connection URLs
• Compromising configuration management systems
• Man-in-the-middle attacks on unencrypted configuration transfers
• Injection into applications that dynamically build connection strings from user input

Detection Methods for CVE-2024-49194

Indicators of Compromise

• Unusual outbound connections to external LDAP, RMI, or DNS servers from systems running the Databricks JDBC Driver
• JDBC connection strings containing suspicious krbJAASFile parameter values, particularly those with ldap://, rmi://, or dns:// schemes
• Unexpected Java class loading or deserialization activity following database connection attempts
• Network traffic to uncommon ports (1099 for RMI, 389/636 for LDAP) from Java application processes

Detection Strategies

• Monitor JDBC connection strings for anomalous parameter values, especially those containing JNDI lookup patterns
• Implement network-level detection for unexpected outbound LDAP/RMI traffic from application servers
• Deploy endpoint detection to identify suspicious Java process behavior following JDBC driver initialization
• Audit configuration files and connection string sources for unauthorized modifications

Monitoring Recommendations

• Enable verbose logging for JDBC driver operations to capture connection parameter details
• Implement egress filtering to block unauthorized outbound connections to LDAP and RMI services
• Monitor for new or modified JAR files and Java classes in application directories
• Set up alerts for failed or unusual database connection attempts with non-standard parameters

How to Mitigate CVE-2024-49194

Immediate Actions Required

• Upgrade the Databricks JDBC Driver to version 2.6.40 or later immediately
• Audit all JDBC connection strings in configuration files and applications for suspicious parameters
• Review access controls on systems and files that store JDBC connection configurations
• Implement network segmentation to limit outbound JNDI-related traffic from application servers

Patch Information

Databricks has released version 2.6.40 of the JDBC Driver which addresses this vulnerability. Organizations should upgrade to this version or later as soon as possible. For detailed information, refer to the Databricks Security Bulletin for CVE-2024-49194.

Workarounds

• If immediate patching is not possible, implement strict input validation on any user-controllable connection string parameters
• Configure Java security policies to restrict JNDI lookups to trusted sources only
• Block outbound LDAP, RMI, and DNS traffic from application servers at the network level
• Use application firewalls to filter potentially malicious JDBC connection strings

# Example: Configure Java to restrict JNDI factory classes (JDK 8u191+ / 11.0.1+)
# Add to Java startup options to limit JNDI code loading
-Dcom.sun.jndi.ldap.object.trustURLCodebase=false
-Dcom.sun.jndi.rmi.object.trustURLCodebase=false