CVE-2025-48999: DataEase SQL Injection Vulnerability

CVE-2025-48999 Overview

CVE-2025-48999 is an access control weakness in DataEase, an open source business intelligence and data visualization platform. The flaw bypasses the previous patch for CVE-2025-46566 in versions prior to 2.10.10. An authenticated attacker can craft a malicious JDBC connection payload for the Redshift datasource. Because getUrlType() returns a value that fails the intended check, the payload skips filtering and reaches the JDBC URL construction logic. This allows injection of dangerous JDBC parameters such as socketFactory, which can be abused to execute code or exfiltrate data. The issue is tracked under [CWE-284] Improper Access Control.

Critical Impact
Authenticated attackers can inject arbitrary JDBC parameters into the Redshift datasource configuration, enabling code execution and data compromise on the DataEase backend.

Affected Products

DataEase versions prior to 2.10.10
Component: dataease:dataease core backend
Redshift datasource type handler (Redshift.java)

Discovery Timeline

2025-06-03 - CVE-2025-48999 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48999

Vulnerability Analysis

The vulnerability resides in the Redshift datasource configuration class in DataEase. The prior fix for CVE-2025-46566 introduced a check based on getUrlType() to decide whether to accept a user-supplied JDBC URL or build one from discrete fields. The check compares getUrlType() against the string hostName and only accepts the raw JDBC URL when the type is not hostName. An attacker who submits a payload where getUrlType() evaluates to a value that makes the conditional return false can bypass the filter added in the earlier patch. The malicious content is then concatenated at the replacement location and used to construct a JDBC connection string containing attacker-controlled parameters.

Root Cause

The root cause is incomplete parameter validation in the JDBC URL builder for the Redshift connector. The previous patch relied solely on a URL-type discriminator to gate filtering, without inspecting the actual JDBC URL contents for dangerous parameters. Attackers can supply parameters such as socketFactory and socketFactoryArg, which the Redshift JDBC driver interprets to load arbitrary classes. This mirrors the well-known JDBC driver attack pattern used against PostgreSQL-compatible drivers.

Attack Vector

Exploitation requires authenticated access to DataEase with permission to configure or modify a Redshift datasource. The attacker submits a datasource configuration containing a crafted JDBC URL. Because the type check does not trigger filtering, the malicious URL is passed to the driver during connection. The driver then loads the attacker-controlled socketFactory class, resulting in code execution in the DataEase backend context.

java

// Patch: filter illegal JDBC parameters in Redshift datasource
private List<String> illegalParameters = Arrays.asList("socketFactory", "socketFactoryArg");

public String getJdbc() {
    if(StringUtils.isNoneEmpty(getUrlType()) && !getUrlType().equalsIgnoreCase("hostName")){
        for (String illegalParameter : illegalParameters) {
            if (URLDecoder.decode(getJdbcUrl()).contains(illegalParameter)) {
                DEException.throwException("Illegal parameter: " + illegalParameter);
            }
        }
        return getJdbcUrl();
    }
    return "jdbc:redshift://HOSTNAME:PORT/DATABASE";
}

Source: GitHub Commit 03b18db. The patch decodes the JDBC URL and rejects any request containing socketFactory or socketFactoryArg.

Detection Methods for CVE-2025-48999

Indicators of Compromise

Redshift datasource entries containing socketFactory or socketFactoryArg parameters in the JDBC URL.
Outbound network connections from the DataEase JVM to unexpected hosts following a datasource save or test-connection action.
New or modified Redshift datasource configurations submitted by non-administrator accounts.
Java class loading events from unusual paths triggered by the DataEase process.

Detection Strategies

Inspect DataEase application logs for datasource creation and validation events referencing the Redshift type.
Perform static review of stored datasource configurations for JDBC URLs containing driver socket factory parameters.
Correlate authentication events with datasource configuration changes to identify unexpected privileged actions.

Monitoring Recommendations

Monitor the DataEase backend for unexpected child processes or reflective class loads.
Alert on outbound TCP connections from the DataEase host to non-approved database endpoints.
Track HTTP requests to datasource configuration endpoints for URL-encoded payloads containing driver keywords.

How to Mitigate CVE-2025-48999

Immediate Actions Required

Upgrade DataEase to version 2.10.10 or later, which includes the illegal parameter filter for the Redshift connector.
Audit existing Redshift datasource configurations and remove entries containing socketFactory or socketFactoryArg.
Restrict datasource configuration privileges to trusted administrators only.
Rotate credentials that were reachable from the DataEase backend if suspicious datasource activity is found.

Patch Information

The fix is delivered in DataEase 2.10.10 via commit 03b18db8. The patch adds an illegalParameters list and validates the URL-decoded JDBC string before returning it. Details are available in the GitHub Security Advisory GHSA-6pq2-6q8x-mp2r.

Workarounds

Block network egress from the DataEase host to untrusted destinations to limit driver-based callbacks.
Place DataEase behind a reverse proxy that filters datasource configuration payloads containing driver socket factory parameters.
Disable the Redshift datasource type if it is not used in the environment.

bash

# Example: verify the running DataEase version and identify vulnerable installs
docker inspect dataease --format '{{.Config.Image}}'
# Upgrade to a fixed release
docker pull dataease/dataease:v2.10.10
docker compose up -d dataease