Ò»¡¢¡¢¡¢·ì϶¸ÅÊö
·ì϶Ãû³Æ | DataEase Redshift JDBC RCE |
CVE ID | CVE-2025-58748 |
·ì϶ÀàÐÍ | RCE | ·¢ÏÖ¹¦·ò | 2025-09-16 |
·ì϶ÆÀ·Ö | 8.7 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»±ØÒª |
PoC/EXP | δ¹«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
DataEaseÊÇÒ»¿î¿ªÔ´µÄÊý¾Ý¿ÉÊÓ»¯Óë·ÖÎöƽ̨£¬£¬Ö§³Ö¶àÖÖÊý¾ÝÔ´½ÓÈ룬£¬Ìṩ±¨±í¡¢¡¢¡¢¿´°å¡¢¡¢¡¢¿ÉÊÓ»¯´óÆÁµÈÖ°ÄÜ£¬£¬Ô®ÊÖÓû§ÊµÏÖÊý¾Ý²éÎÊ¡¢¡¢¡¢·ÖÎöÓëչʾ¡£¡£¡£ËüÖ§³ÖJDBC¡¢¡¢¡¢APIµÈ¶àÖÖÊý¾ÝÏνӷ½Ê½£¬£¬ºÏÓÃÓÚBI±¨±í¡¢¡¢¡¢Êý¾Ý·ÖÎö¼°¿ÉÊÓ»¯³¡¾°¡£¡£¡£
2025Äê9ÔÂ16ÈÕ£¬£¬OG¶«·½Ìü¼¯ÍÅVSRC¼à²âµ½DataEase´æÔÚRedshift JDBCÈƹýµ¼ÖÂÔ¶³Ì´úÂëÖ´Ðеķì϶£¬£¬ÓÉÓÚδ¶ÔH2 JDBCǰ׺×öÑϸñУÑ飬£¬ÏµÍ³»á½ÓÊÜʹÓÃcom.amazon.redshift.jdbc42.DriverµÄÏνӴ®£¬£¬¹¥»÷Õß¿Éͨ¹ýÔÚsocketFactory/socketFactoryArgÖÐÖ¸Ïò¶ñÒâSpring XMLÔØÈëÀàõ辶/Îļþϵͳ¸ßµÍÎIJ¢´¥·¢RCE¡£¡£¡£·ì϶ÆÀ·Ö8.7£¬£¬·ì϶¼¶±ð¸ßΣ¡£¡£¡£
¶þ¡¢¡¢¡¢Ó°ÏìÁìÓò
Èý¡¢¡¢¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
ÒÑ°ä²¼ÐÞ¸´°æ±¾£¬£¬Ç뽫DataEaseÉý¼¶µ½2.10.13°æ±¾¡£¡£¡£
ÏÂÔØÁ´½Ó£º£ºhttps://github.com/dataease/dataease/releases/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÖÆ£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬¹Ø±Õ·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢¡¢¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£? ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÖƺÍ×îСȨÏÞ×¼Ôò£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://github.com/dataease/dataease/security/advisories/GHSA-23qw-9qrh-9rr8/https://www.tenable.com/cve/CVE-2025-58748/
¾©¹«Íø°²±¸11010802024551ºÅ