Unauthenticated JDBC Injection in AllData

AllData through version 0.7.1 contains a critical JDBC injection vulnerability in the data-dts component. The flaw exists within the /jobJdbcDatasource/test endpoint, which fails to properly validate user-supplied jdbcUrl and jdbcDriverClass parameters. An unauthenticated remote attacker can exploit this by submitting a specially crafted MySQL JDBC connection string. By setting the allowLoadLocalInfile property to true, an attacker can coerce the application server into initiating a connection to an attacker-controlled MySQL server. Once the connection is established, the attacker can leverage the LOAD DATA LOCAL INFILE capability to extract arbitrary files from the AllData host filesystem, leading to the exposure of sensitive configuration data, credentials, or system files.

Attack Chain

1. Attacker identifies the target AllData instance and the accessible /jobJdbcDatasource/test endpoint.
2. Attacker sets up a rogue, internet-accessible MySQL server configured to receive incoming connections.
3. Attacker sends an unauthenticated HTTP POST request to the target endpoint containing malicious JDBC parameters.
4. The jdbcUrl parameter is set to include the malicious server address and the enableLoadLocalInfile=true flag.
5. The target application initiates a database connection request to the attacker's server.
6. The attacker's server responds with a request for a file from the host filesystem.
7. The target host reads the requested file and exfiltrates its contents to the attacker's infrastructure.

Impact

Successful exploitation allows for the unauthorized reading of arbitrary files from the AllData host. This can lead to the compromise of internal system security by exposing sensitive configuration files, environment variables, or private keys. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating a significant risk to confidentiality.

Recommendation

• Immediately upgrade AllData to a version beyond 0.7.1 that remediates this vulnerability.
• Monitor webserver access logs for POST requests to the /jobJdbcDatasource/test path originating from unauthorized or external IP addresses.
• Restrict network access to the AllData management interface and specifically the /jobJdbcDatasource/test endpoint to trusted internal networks only.
• Implement egress filtering on the AllData host to block unexpected outbound MySQL (3306) or database-related connection attempts to untrusted external destinations.