{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/alldata--0.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:alldata:alldata:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111613"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AllData (\u003c= 0.7.1)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","jdbc-injection","data-exfiltration"],"_cs_type":"advisory","_cs_vendors":["AllData"],"content_html":"\u003cp\u003eAllData through version 0.7.1 contains a critical JDBC injection vulnerability in the data-dts component. The flaw exists within the /jobJdbcDatasource/test endpoint, which fails to properly validate user-supplied jdbcUrl and jdbcDriverClass parameters. An unauthenticated remote attacker can exploit this by submitting a specially crafted MySQL JDBC connection string. By setting the allowLoadLocalInfile property to true, an attacker can coerce the application server into initiating a connection to an attacker-controlled MySQL server. Once the connection is established, the attacker can leverage the LOAD DATA LOCAL INFILE capability to extract arbitrary files from the AllData host filesystem, leading to the exposure of sensitive configuration data, credentials, or system files.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies the target AllData instance and the accessible /jobJdbcDatasource/test endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker sets up a rogue, internet-accessible MySQL server configured to receive incoming connections.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP POST request to the target endpoint containing malicious JDBC parameters.\u003c/li\u003e\n\u003cli\u003eThe jdbcUrl parameter is set to include the malicious server address and the enableLoadLocalInfile=true flag.\u003c/li\u003e\n\u003cli\u003eThe target application initiates a database connection request to the attacker's server.\u003c/li\u003e\n\u003cli\u003eThe attacker's server responds with a request for a file from the host filesystem.\u003c/li\u003e\n\u003cli\u003eThe target host reads the requested file and exfiltrates its contents to the attacker's infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized reading of arbitrary files from the AllData host. This can lead to the compromise of internal system security by exposing sensitive configuration files, environment variables, or private keys. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating a significant risk to confidentiality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade AllData to a version beyond 0.7.1 that remediates this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor webserver access logs for POST requests to the /jobJdbcDatasource/test path originating from unauthorized or external IP addresses.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the AllData management interface and specifically the /jobJdbcDatasource/test endpoint to trusted internal networks only.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering on the AllData host to block unexpected outbound MySQL (3306) or database-related connection attempts to untrusted external destinations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:46:54Z","date_published":"2026-10-16T18:46:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-alldata-jdbc-injection/","summary":"AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.","title":"Unauthenticated JDBC Injection in AllData","url":"https://feed.craftedsignal.io/briefs/2026-10-alldata-jdbc-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - AllData (\u003c= 0.7.1)","version":"https://jsonfeed.org/version/1.1"}