CVE-2025-57773 in DataEase
Summary
by MITRE • 08/26/2025
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerability has been fixed in version 2.10.12.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2025
The vulnerability CVE-2025-57773 affects DataEase, an open source business intelligence and data visualization platform, exposing a critical JNDI injection flaw that has been addressed in version 2.10.12. This vulnerability stems from inadequate filtering of DB2 parameters within the application's input handling mechanisms, creating an exploitable entry point for remote attackers to initiate JNDI injection attacks. The flaw represents a significant security weakness that directly impacts the integrity and confidentiality of data processing operations within the platform.
The technical exploitation of this vulnerability involves a multi-layered attack chain that begins with the JNDI injection vector, which then triggers a deserialization attack through AspectJWeaver components. Specifically, the attack leverages the AspectJWeaver deserialization mechanism to write arbitrary files to the system, effectively allowing for remote code execution and data manipulation. The attack requires the presence of specific vulnerable libraries including commons-collections 4.x and aspectjweaver-1.9.22.jar, which serve as necessary components for the exploitation chain to function properly. This dependency chain demonstrates the complex nature of modern application vulnerabilities where multiple components must be present for successful exploitation to occur.
The operational impact of this vulnerability extends beyond simple data compromise, as it enables attackers to perform arbitrary file operations on the affected system. This capability allows for persistent backdoor installation, data exfiltration, and potential lateral movement within the network infrastructure. The vulnerability's exposure of the underlying JNDI injection mechanism means that attackers can potentially access sensitive database connections and credentials stored within the application's configuration, leading to broader system compromise. Organizations using DataEase versions prior to 2.10.12 face significant risk of unauthorized access and data breaches.
Security practitioners should prioritize immediate patching of affected systems to mitigate this vulnerability, as the exploitation requires minimal prerequisites and offers substantial attack surface. The fix implemented in version 2.10.12 addresses the root cause by properly filtering DB2 parameters and implementing robust input validation controls. Organizations should also conduct comprehensive security assessments of their DataEase deployments to identify any potential exploitation attempts and ensure that vulnerable library versions have been removed or updated. This vulnerability aligns with CWE-94, which describes the improper control of generation of code, and maps to ATT&CK technique T1059.007 for remote code execution, emphasizing the critical nature of this security flaw in enterprise environments.