CVE-2026-40899: DataEase: JDBC parameter blocklist bypass via Lombok @Data setter exposure

DataEase community edition ≤ v2.10.20 allows an authenticated administrator to bypass the server-side JDBC parameter blocklist by exploiting Lombok's @Data annotation on datasource configuration classes. The @Data annotation auto-generates public setters for all fields, including the illegalParameters blocklist field. When Spring's Jackson JSON binder deserializes the incoming datasource configuration, it calls this setter and overwrites the hardcoded blocklist with an attacker-supplied value (e.g., an empty array). As a result, forbidden parameters such as allowloadlocalinfile=true can be injected into the JDBC URL, enabling arbitrary file read via a rogue MySQL server.

• Package/component affected: core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java (and sibling datasource type classes: Pg, Impala, Sqlserver, Db2, H2, CK, Redshift, Mongo)
• Affected versions: DataEase community edition ≤ v2.10.20
• Fixed versions: v2.10.21
• Risk level: Medium (CVSS 3.1: 6.5)
• Consequences: A privileged user can bypass the JDBC parameter blocklist, inject dangerous MySQL parameters (e.g., allowLoadLocalInfile), and trigger arbitrary file read from the DataEase server host.

Root Cause

The datasource type classes (e.g., Mysql.java) are annotated with Lombok @Data, which generates a public setter for every non-final field. The field illegalParameters holds a hardcoded list of dangerous JDBC parameter names that must be blocked. Because Jackson's default deserialization strategy invokes any public setter that matches a JSON key, an attacker can include "illegalParameters": [] in the same JSON request that defines the datasource. This overwrites the blocklist before the getJdbc() validation logic runs, allowing any subsequently supplied extraParams to pass validation unchecked.

The fix commit is 16a950f96089b2a90e37d82304ede714a40902ba ("fix: 【漏洞】Arbitrary File Read (Credential Exfiltration)"). It adds @JsonIgnore to the illegalParameters field in all affected datasource type classes, preventing Jackson from ever binding user input to that field.

Reproduction Steps

1. Run repro/reproduction_steps.sh
2. The script:
   • Pulls the official DataEase Docker images for v2.10.20 (vulnerable) and v2.10.21 (fixed)
   • Starts each image in desktop mode (which bypasses token-based authentication) on separate ports
   • Waits for the real /de2api/datasource/types endpoint to respond
   • Sends an HTTP POST to /de2api/datasource/validate with a Base64-encoded malicious MySQL configuration containing "illegalParameters": [] and "extraParams": "allowloadlocalinfile=true"
   • Captures and compares the responses
3. Expected evidence:
   • Vulnerable (v2.10.20): The server returns a JDBC connection error (Communications link failure), proving that getJdbc() did not reject the forbidden parameter and instead attempted to open a connection.
   • Fixed (v2.10.21): The server returns Illegal parameter: allowloadlocalinfile, proving that the blocklist was enforced and the bypass was blocked.

Evidence

• logs/vulnerable_response.json:

  {"code":40001,"msg":"DEException(code=40001, msg=Communications link failure\n\nThe last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.)","data":null}
  

• logs/fixed_response.json:

  {"code":40001,"msg":"DEException(code=40001, msg=Illegal parameter: allowloadlocalinfile)","data":null}
  

• repro/runtime_manifest.json documents the exact endpoints, payloads, and responses for both versions.

Recommendations / Next Steps

1. Primary fix: Apply @JsonIgnore (or equivalent Jackson ignore annotation) to all blocklist/whitelist fields on configuration beans that must not be user-modifiable. This is exactly what the DataEase maintainers did in v2.10.21.
2. Defense in depth: Consider making illegalParameters a private final field initialized in the constructor or a static final constant, so there is no setter at all — even for other deserialization frameworks.
3. Upgrade guidance: Users on DataEase ≤ v2.10.20 should upgrade to v2.10.21 or later immediately.
4. Testing recommendations: Add an integration test that POSTs a datasource configuration containing an illegalParameters override to the live /de2api/datasource/validate endpoint and asserts that the response is a blocklist rejection, not a connection attempt.

Additional Notes

• Idempotency: repro/reproduction_steps.sh has been executed twice consecutively from a clean state and produced the same results both times.
• Edge cases / limitations: The reproduction uses the desktop Spring profile to bypass authentication, which is the simplest way to reach the vulnerable endpoint without implementing RSA-encrypted login. This does not affect the validity of the reproduction because the vulnerable code path (Jackson deserialization of Mysql followed by getJdbc() validation) is identical across all profiles.