CVE-2025-10703: Progress DataDirect JDBC RCE Vulnerability

CVE-2025-10703 Overview

CVE-2025-10703 is a code injection vulnerability [CWE-94] affecting Progress DataDirect Connect for JDBC drivers, the DataDirect Open Access JDBC driver, and Hybrid Data Pipeline. The flaw resides in the SpyAttribute connection option, which exposes a log=(file) construct that lets callers specify an arbitrary log file path. Attackers who control the SpyAttributes value can write attacker-supplied JavaScript into a log file. When that file is placed inside an application server's web-served path with a recognized extension, the server treats it as a resource. Subsequent requests retrieve and execute the JavaScript in the victim's browser context, enabling remote code inclusion.

Critical Impact
Adversaries can plant attacker-controlled JavaScript on application servers through the JDBC driver log writer, leading to script execution against any user that loads the resulting resource.

Affected Products

DataDirect Connect for JDBC drivers (Amazon Redshift, Apache Cassandra, Hive, Impala, SparkSQL, Autonomous REST, DB2, Google Analytics 4, BigQuery, Greenplum, Informix, Microsoft Dynamics 365, SQL Server, SharePoint, MongoDB, MySQL, Oracle Database, Eloqua, Sales Cloud, Service Cloud, PostgreSQL, OpenEdge, Salesforce, SAP HANA, SAP S/4 HANA, Sybase ASE, Snowflake)
DataDirect Hybrid Data Pipeline Server through 4.6.2.3309, JDBC Driver through 4.6.2.0607, On Premises Connector through 4.6.2.1223, Docker through 4.6.2.3316
DataDirect OpenAccess JDBC Driver through 8.1.0.0177 and 9.0.0.0019

Discovery Timeline

2025-11-19 - CVE-2025-10703 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10703

Vulnerability Analysis

The vulnerability stems from how the DataDirect JDBC Spy logging facility handles untrusted input. SpyAttributes is a connection-string option that controls diagnostic logging for the driver. The log=(file) sub-option accepts a fully attacker-controllable destination path and writes log content verbatim. Because the writer performs no sanitization on log content or constraints on the destination, an adversary supplying both a malicious connection string and crafted log-producing values can shape file contents and location simultaneously.

When the chosen path resolves inside a web application's static or JSP-served directory and uses an extension the application server recognizes (such as .js, .html, or .jsp), the log file becomes a servable resource. Fetching the URL causes the application server to deliver the attacker's JavaScript, which executes in the requesting browser. This combines insecure file write primitives with downstream code execution on resource retrieval.

Root Cause

The root cause is improper control of code generation [CWE-94] inside the Spy logging subsystem. The driver allows the calling application to forward end-user input directly into SpyAttributes without filtering destination paths, file extensions, or written content. No allowlist constrains where logs are written, and no encoding is applied to log entries that may end up rendered as code.

Attack Vector

Exploitation requires an application that propagates user-controlled input into the JDBC connection string's SpyAttributes value. The attacker supplies a SpyAttributes payload that sets log=(file) to a path inside a web-served directory with a script-capable extension. The attacker then triggers driver activity that emits log entries containing JavaScript. Finally, the attacker requests the URL corresponding to the planted file, causing the application server to serve the resource and the browser to execute the embedded script.

No synthetic exploit code is published here. Refer to the Progress DataDirect Security Bulletin for vendor technical details.

Detection Methods for CVE-2025-10703

Indicators of Compromise

Unexpected files with .js, .html, .jsp, or similar web-served extensions appearing inside application server web roots or static asset directories.
JDBC connection strings or application logs containing the substring SpyAttributes with a log=(file= clause referencing paths outside standard log directories.
DataDirect Spy log files whose contents include <script> tags, HTML markup, or JavaScript syntax rather than diagnostic records.

Detection Strategies

Inspect application configuration and runtime traffic for user-controllable parameters that flow into JDBC connection strings, focusing on SpyAttributes usage.
Hash and inventory web-served directories, then alert on new files created by the Java process running the JDBC driver.
Correlate file-write events from JVM processes with subsequent HTTP GET requests retrieving those file paths.

Monitoring Recommendations

Enable file integrity monitoring on application server document roots and static content directories.
Log all JDBC connection establishment events and capture full connection-string properties for review.
Monitor outbound HTTP responses for newly served script resources that did not exist in the previous deployment baseline.

How to Mitigate CVE-2025-10703

Immediate Actions Required

Upgrade each affected DataDirect component to the fixed build listed in the Progress advisory, including Hybrid Data Pipeline Server 4.6.2.3430, Hybrid Data Pipeline JDBC Driver 4.6.2.1023, and OpenAccess JDBC Driver 8.1.0.0183 or 9.0.0.0022.
Audit all applications that build JDBC connection strings from external input and remove or strictly validate any SpyAttributes pass-through.
Retire deployments of DataDirect Connect for JDBC for SAP HANA, which Progress has discontinued rather than patched.

Patch Information

Progress published fixed versions across the affected product line in the November 2025 advisory. Examples include DataDirect Connect for JDBC for Microsoft SQL Server 6.0.0.001957, Oracle Database 6.0.0.001776, PostgreSQL 6.0.0.001856, Salesforce 6.0.0.003125, Snowflake 6.0.1.001856, and MongoDB 6.1.0.001669. Consult the Progress DataDirect Security Bulletin for the complete fixed-version matrix.

Workarounds

Reject or sanitize any application input that can influence JDBC connection properties, particularly SpyAttributes, and enforce a server-side allowlist of supported connection options.
Configure the application server to deny serving files from directories writable by the JDBC driver, or relocate driver log destinations to paths outside any web-served root.
Restrict file system permissions for the JVM process so it cannot write to application server document roots or static asset directories.

bash

# Configuration example: deny script execution in any directory that could receive driver logs
# Apache Tomcat - block static serving of paths used for diagnostic logs
<Context>
  <Resources allowLinking="false" />
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         deny=".*" addConnectorPort="true"
         path="/logs/*"/>
</Context>

# Linux - prevent JVM user from writing into web roots
chown -R root:root /var/lib/tomcat/webapps
find /var/lib/tomcat/webapps -type d -exec chmod 755 {} \;