CVE-2025-62420: DataEase JDBC Driver Bypass RCE Vulnerability

CVE-2025-62420 Overview

DataEase is an open-source data visualization and analytics platform. CVE-2025-62420 is a JDBC driver bypass vulnerability affecting DataEase versions through 2.10.13. The flaw resides in the H2 database connection handler, where the getJdbc function in H2.java validates that the jdbcUrl field begins with jdbc:h2 but returns a separate jdbc field as the actual connection URL. An authenticated attacker can supply a compliant jdbcUrl alongside a malicious jdbc field referencing an arbitrary driver and connection string. This bypass enables arbitrary JDBC connections that can lead to remote code execution. The issue is resolved in version 2.10.14.

Critical Impact

An authenticated attacker can bypass JDBC URL validation to load arbitrary JDBC drivers, resulting in remote code execution on the DataEase server.

Affected Products

• DataEase versions up to and including 2.10.13
• DataEase H2 database connection handler (H2.java)
• DataEase Db2 database connection handler (Db2.java)

Discovery Timeline

• 2025-10-17 - CVE-2025-62420 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-62420

Vulnerability Analysis

The vulnerability is classified as Deserialization of Untrusted Data ([CWE-502]) because attacker-controlled JDBC connection parameters can trigger driver behaviors that deserialize remote payloads. DataEase exposes a data source configuration interface that accepts both a jdbcUrl value and a jdbc value. The validation logic only inspects jdbcUrl to confirm it begins with jdbc:h2, then returns the unvalidated jdbc string to the connection layer. The connection layer uses the unvalidated value to load any JDBC driver an attacker specifies, including drivers known to enable code execution through JNDI lookups or backend RCE primitives.

Root Cause

The root cause is a check-versus-use mismatch in getJdbc within H2.java. The method validates one field (jdbcUrl) but returns a different field (jdbc) for downstream use. Because the two values are decoupled, the security check provides no protection over the value actually consumed by the JDBC driver manager.

Attack Vector

An authenticated user with permission to configure data sources submits a crafted H2 datasource definition. The jdbcUrl parameter is set to a benign value beginning with jdbc:h2 to satisfy the validator. The jdbc parameter carries the attacker-chosen driver string, such as a MySQL, PostgreSQL, or other connector URL referencing a malicious backend. When DataEase establishes the connection, the malicious driver executes attacker-controlled logic on the server.

// Security patch in core/core-backend/src/main/java/io/dataease/datasource/type/H2.java
// The check now validates the actual jdbc value returned to the caller
            DEException.throwException("Has illegal parameter: " + jdbc);
        }
    }
-   if (StringUtils.isNotEmpty(getJdbcUrl()) && !getJdbcUrl().startsWith("jdbc:h2")) {
-       DEException.throwException("Illegal jdbcUrl: " + getJdbcUrl());
+   if (StringUtils.isNotEmpty(jdbc) && !jdbc.startsWith("jdbc:h2")) {
+       DEException.throwException("Illegal jdbcUrl: " + jdbc);
    }
    return jdbc;
}

Source: DataEase patch commit bb320e4. The fix aligns the validated field with the returned field, so any non-jdbc:h2 value is rejected before being used.

Detection Methods for CVE-2025-62420

Indicators of Compromise

• Data source configuration requests containing both jdbcUrl and jdbc parameters with mismatched prefixes or driver schemes.
• Outbound network connections from the DataEase server to unexpected database hosts, LDAP servers, or RMI endpoints following data source operations.
• Unexpected child processes spawned by the DataEase Java process after data source test or save actions.

Detection Strategies

• Inspect HTTP request bodies sent to DataEase data source endpoints for jdbc values that do not start with jdbc:h2 while jdbcUrl does.
• Audit DataEase application logs for Illegal jdbcUrl exceptions, which indicate the patched validator is rejecting suspicious values post-upgrade.
• Correlate authenticated session activity with new outbound JDBC connections to hosts outside the approved database inventory.

Monitoring Recommendations

• Enable verbose logging on DataEase data source creation and modification events, including the full submitted parameters.
• Monitor the DataEase host for JNDI lookups, class loader activity from remote URLs, and use of drivers other than H2 when only H2 sources are expected.
• Alert on any process execution originating from the DataEase JVM that is not part of normal application behavior.

How to Mitigate CVE-2025-62420

Immediate Actions Required

• Upgrade DataEase to version 2.10.14 or later, which contains the patch in commit bb320e4.
• Restrict data source configuration privileges to a minimum set of trusted administrative accounts until the upgrade is complete.
• Review existing data sources for entries with non-H2 jdbc values and remove any unauthorized configurations.

Patch Information

The vulnerability is fixed in DataEase 2.10.14. The patch updates both H2.java and Db2.java so that the value returned to the JDBC driver manager is the value subject to prefix validation and illegal-parameter filtering. Details are available in the GitHub Security Advisory GHSA-7wcv-j6gc-qc7q and the DataEase commit bb320e4.

Workarounds

• No official workarounds exist according to the vendor advisory; upgrading is required.
• As a compensating control, place DataEase behind network egress filtering that only permits connections to known, approved database hosts and ports.
• Disable or remove unused database connector libraries from the DataEase classpath to reduce the set of drivers an attacker could abuse.

# Verify and upgrade the DataEase deployment to the patched release
docker pull dataease/dataease:v2.10.14
docker stop dataease && docker rm dataease
# Recreate the container with the patched image using your existing volume and env config
# Confirm the running version after restart
curl -s http://<dataease-host>/de2api/sysParameter/version | grep -i version