CVE-2026-11457: JeeWMS JimuReport RCE Vulnerability

CVE-2026-11457 Overview

CVE-2026-11457 affects erzhongxmu JeeWMS up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69. The flaw resides in the /base-boot/jmreport/testConnection endpoint exposed by the JimuReport test-connection component. Attackers can manipulate the dbType, dbDriver, dbUrl, dbUsername, and dbPassword parameters to trigger an injection condition classified under [CWE-74]. Remote exploitation requires no authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. JeeWMS uses a rolling release model, so no fixed version is identified. The vendor was contacted but did not respond to the disclosure.

Critical Impact
Unauthenticated remote attackers can inject malicious values into database connection parameters processed by the JimuReport test-connection endpoint, affecting confidentiality, integrity, and availability.

Affected Products

erzhongxmu JeeWMS (rolling release) up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69
JimuReport test-connection component bundled with affected JeeWMS builds
Deployments exposing the /base-boot/jmreport/testConnection endpoint to untrusted networks

Discovery Timeline

2026-06-07 - CVE-2026-11457 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11457

Vulnerability Analysis

The vulnerability is an injection flaw [CWE-74] in the JimuReport reporting component embedded in JeeWMS. The /base-boot/jmreport/testConnection endpoint accepts user-supplied database connection parameters and passes them to backend logic without sufficient validation. An unauthenticated remote attacker can submit crafted values for dbType, dbDriver, dbUrl, dbUsername, or dbPassword to influence connection construction. Depending on the JDBC driver involved, attackers can manipulate connection URLs to coerce the server into contacting attacker-controlled infrastructure or loading malicious driver properties. The exploit code is public, and the rolling release model complicates patch tracking for defenders.

Root Cause

The root cause is improper neutralization of special elements in connection parameters supplied to the test-connection handler. The endpoint trusts client-controlled values and forwards them to JDBC connection routines without enforcing allow-lists for drivers, hostnames, or URL parameters.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP request to /base-boot/jmreport/testConnection with malicious values in the database connection parameters. The server then processes the injected values during the connection test, yielding limited impact across confidentiality, integrity, and availability.

No verified proof-of-concept code is published in the enriched data. Refer to the GitHub Issue Report and VulDB Vulnerability Details for technical specifics.

Detection Methods for CVE-2026-11457

Indicators of Compromise

HTTP requests to /base-boot/jmreport/testConnection from external or untrusted source addresses
Requests containing unusual dbUrl values referencing external hosts, jdbc: schemes with attacker-controlled parameters, or unexpected JDBC drivers in dbDriver
Outbound database or HTTP connections from the JeeWMS application server to unfamiliar destinations following test-connection requests

Detection Strategies

Inspect web server and application logs for POST or GET activity targeting the testConnection endpoint, especially without prior authenticated session context
Alert on parameter values in dbType, dbDriver, dbUrl, dbUsername, or dbPassword containing suspicious tokens such as ;, backticks, --, or driver-specific properties enabling code loading
Correlate test-connection requests with subsequent egress traffic from the application host to identify successful exploitation attempts

Monitoring Recommendations

Enable verbose logging on the JimuReport module and forward records to a centralized SIEM for retention and correlation
Monitor process and network telemetry on JeeWMS servers for anomalous JDBC driver loads or unexpected outbound connections
Track requests per client IP to the reporting endpoints and rate-limit or block sources exhibiting reconnaissance patterns

How to Mitigate CVE-2026-11457

Immediate Actions Required

Restrict network access to /base-boot/jmreport/testConnection so it is reachable only from trusted administrative networks
Place JeeWMS behind a web application firewall with rules that block injection patterns in database connection parameters
Audit application and database server logs for prior exploitation attempts against the JimuReport endpoint

Patch Information

JeeWMS follows a rolling release approach, and the vendor did not respond to disclosure. No specific fixed version is available. Operators should track upstream commits after 141740afb2ba14d441c82a833d0a418d07ca2d69 and validate that test-connection parameters are properly constrained before deploying updates. See the VulDB CVE Entry for tracking updates.

Workarounds

Disable or remove the JimuReport test-connection endpoint if it is not required for business operations
Enforce authentication and role-based access control on all JimuReport administrative routes via reverse proxy rules
Apply an allow-list of permitted JDBC drivers and URL schemes at the application or proxy layer to reject untrusted values

bash

# Example nginx rule to restrict access to the vulnerable endpoint
location /base-boot/jmreport/testConnection {
    allow 10.0.0.0/8;        # internal admin network
    deny all;
    proxy_pass http://jeewms_backend;
}