CVE-2025-58045
📋 TL;DR
This vulnerability in Dataease allows attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF) attacks. In Dataease versions up to 2.10.12, the ldap parameter was not properly filtered, enabling SSRF exploitation. All users running affected versions are vulnerable to this attack.
💻 Affected Systems
- Dataease
📦 What is this software?
Dataease by Dataease
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use SSRF to access internal systems, exfiltrate data, or pivot to other attacks, potentially leading to full system compromise.
Likely Case
Attackers exploit SSRF to scan internal networks, access internal services, or perform data exfiltration from systems reachable from the Dataease server.
If Mitigated
With proper network segmentation and egress filtering, SSRF impact is limited to accessible internal systems only.
🎯 Exploit Status
SSRF exploitation typically requires minimal technical skill once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.13
Vendor Advisory: https://github.com/dataease/dataease/security/advisories/GHSA-fmq3-6xhc-r845
Restart Required: Yes
Instructions:
1. Backup your Dataease instance and data. 2. Download Dataease version 2.10.13 or later from official sources. 3. Stop the Dataease service. 4. Replace the existing installation with the new version. 5. Restart the Dataease service. 6. Verify the update was successful.
🧯 If You Can't Patch
- Implement strict network egress filtering to limit outbound connections from the Dataease server.
- Deploy web application firewall (WAF) rules to block malicious connection strings containing ldap parameters.
🔍 How to Verify
Check if Vulnerable:
Check the Dataease version in the web interface or configuration files. If version is 2.10.12 or lower, the system is vulnerable.Check Version:
Check the version in the Dataease web interface under Settings > About, or examine the application configuration files.Verify Fix Applied:
After updating, verify the version shows 2.10.13 or higher in the web interface or configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connection attempts from Dataease server
- LDAP connection attempts in application logs
- Malformed JDBC connection strings in logs
Network Indicators:
- Unexpected outbound connections from Dataease server to internal systems
- LDAP protocol traffic from Dataease server
SIEM Query:
source="dataease" AND (ldap OR jdbc) AND (connection OR string)