CVE-2024-55551 | BDVDB-2026-270701 Detail
ExasolJDBC driver
Description#
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-471 Modification of Assumed-Immutable Data (MAID)
References#
- https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179
- https://docs.exasol.com/db/latest/connect_exasol/drivers/jdbc.htm
- https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f
- https://docs.exasol.com/db/7.1/release_notes_drivers_jdbc/24.2.1.htm
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.