CVE-2025-10702: Progress DataDirect JDBC Drivers RCE Flaw

CVE-2025-10702 Overview

CVE-2025-10702 is a code injection vulnerability ([CWE-94]) affecting Progress DataDirect Connect for JDBC drivers, the DataDirect OpenAccess JDBC driver, and DataDirect Hybrid Data Pipeline. The flaw resides in the SpyAttributes connection option, which supports an undocumented syntax that allows loading an arbitrary class from the classpath and executing its constructor. Applications that pass user-controlled values into SpyAttributes expose themselves to remote code inclusion. Progress published fixed builds across more than two dozen JDBC connectors in November 2025.

Critical Impact
Attackers who control the SpyAttributes connection option can force the driver to instantiate arbitrary classes on the JVM classpath, leading to remote code execution within the host application.

Affected Products

Progress DataDirect Connect for JDBC drivers (Amazon Redshift, Cassandra, Hive, Impala, SparkSQL, DB2, BigQuery, Greenplum, Informix, Microsoft SQL Server, Oracle, PostgreSQL, Salesforce, Snowflake, Sybase ASE, and others)
Progress DataDirect Hybrid Data Pipeline Server, JDBC Driver, On-Premises Connector, and Docker images (through 4.6.2.3309 / 4.6.2.0607 / 4.6.2.1223 / 4.6.2.3316)
Progress DataDirect OpenAccess JDBC Driver versions through 8.1.0.0177 and 9.0.0.0019

Discovery Timeline

2025-11-19 - CVE-2025-10702 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10702

Vulnerability Analysis

The DataDirect JDBC drivers expose a SpyAttributes connection option intended to configure diagnostic logging (the DataDirect Spy facility). The option parser accepts an undocumented syntax that goes beyond simple attribute key/value pairs. When this syntax appears in the option value, the driver resolves a class name from the JVM classpath and invokes its constructor.

Any application that lets an end user influence the JDBC connection string or supply a SpyAttributes value inherits the flaw. Examples include data integration tools, BI front-ends, low-code platforms, and admin consoles that build JDBC URLs from user input. The attacker does not need to upload code; any constructor reachable on the existing classpath that performs sensitive actions becomes a usable gadget.

Root Cause

The root cause is improper control of code generation ([CWE-94]) in the SpyAttributes parser. The parser treats parts of the attribute value as a class loader directive rather than as opaque configuration data. No allowlist constrains which classes may be loaded, and no signed-configuration check governs the parsed input.

Attack Vector

Exploitation is network-reachable and requires low privileges, with no user interaction. The attacker submits a crafted SpyAttributes value through whatever channel the host application exposes (web form, API parameter, or connection profile). The driver loads the attacker-selected class and runs its constructor inside the JVM that hosts the application, yielding code execution under the application's identity. Refer to the Progress DataDirect Security Bulletin for vendor technical details.

Detection Methods for CVE-2025-10702

Indicators of Compromise

JDBC connection strings or application logs containing SpyAttributes values with unexpected punctuation, class-name-like tokens, or fully qualified Java package paths.
Unexpected child processes or new threads spawned by Java application servers hosting DataDirect drivers shortly after a database connection attempt.
Class loader events in the JVM that resolve classes not part of the application's normal dependency graph.

Detection Strategies

Inspect application and proxy logs for inbound requests that set or influence SpyAttributes, particularly from untrusted users.
Enable DataDirect Spy logging temporarily in a controlled environment to baseline legitimate SpyAttributes values, then alert on deviations.
Hunt for outbound network connections originating from JVMs that host JDBC drivers immediately following connection establishment.

Monitoring Recommendations

Forward application server, JDBC, and JVM telemetry into a SIEM and correlate connection-string parameters with subsequent process and network behavior. The Singularity Data Lake supports this correlation at scale through OCSF-normalized ingestion.
Use endpoint behavioral monitoring on servers running affected JDBC clients to flag anomalous child-process creation or scripting activity from Java processes. Singularity Endpoint provides behavioral identification for this pattern.
Audit configuration management systems and source repositories for stored connection profiles that include SpyAttributes.

How to Mitigate CVE-2025-10702

Immediate Actions Required

Inventory every application that embeds a DataDirect Connect for JDBC, Hybrid Data Pipeline, or OpenAccess JDBC driver and identify the build number in use.
Block end-user input from reaching the SpyAttributes option by stripping or rejecting the parameter at the application layer.
Restrict outbound network egress from JVMs hosting the affected drivers to limit post-exploitation pivots.
Rotate any credentials accessible to application servers that have processed untrusted JDBC connection input.

Patch Information

Progress released fixed builds for each affected connector. Notable fixed versions include DataDirect Connect for JDBC for Microsoft SQL Server 6.0.0.001957, Oracle Database 6.0.0.001776, PostgreSQL 6.0.0.001856, Snowflake 6.0.1.001856, Salesforce 6.0.0.003125, Hybrid Data Pipeline Server 4.6.2.3430, Hybrid Data Pipeline JDBC Driver 4.6.2.1023, and OpenAccess JDBC 8.1.0.0183 / 9.0.0.0022. DataDirect Connect for JDBC for SAP HANA has been retired and will not receive a fix. Consult the Progress DataDirect Security Bulletin for the complete version matrix.

Workarounds

Treat the JDBC connection string as a server-side secret and never accept SpyAttributes from clients or untrusted configuration sources.
Enforce an allowlist of permitted connection options at the application layer and reject any string that contains SpyAttributes.
Run JVMs that host these drivers with a Java Security Manager policy or container-level restrictions that limit class loading and process execution.

bash

# Example: strip SpyAttributes from a JDBC URL before use
JDBC_URL="$(echo "$RAW_URL" | sed -E 's/([;?&])SpyAttributes=[^;&]*//gI')"
export JDBC_URL