Vulnérabilité d'Improper Control of Generation of Code ('Code Injection') dans les pilotes Progress DataDirect Connect for JDBC, le pilote Progress DataDirect Open Access JDBC et Hybrid Data Pipeline permet l'inclusion de code à distance. L'option de connexion SpyAttribute implémentée par les pilotes DataDirect Connect for JDBC, le pilote DataDirect Hybrid Data Pipeline JDBC et le pilote DataDirect OpenAccess JDBC prend en charge une construction de syntaxe non documentée pour la valeur de l'option qui, si elle est découverte, peut être utilisée par un attaquant.

The vulnerability lies in the improper handling of the SpyAttribute connection option. This option, intended for debugging and monitoring purposes, contains an undocumented syntax that attackers can exploit. By crafting malicious input for this option, an attacker can inject and execute arbitrary code on the server hosting the JDBC driver. This could lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of persistent malware. The blast radius extends to any application utilizing these JDBC drivers, particularly those allowing user-controlled input to influence connection parameters. This is similar in concept to other JDBC injection vulnerabilities where improperly sanitized connection strings are exploited.

Applications utilizing Progress DataDirect JDBC drivers, particularly those deployed in environments where user-supplied data is used to configure JDBC connections, are at risk. Shared hosting environments where multiple applications share the same JDBC driver instance are especially vulnerable, as a compromise in one application could potentially affect others.

• linux / server:

journalctl -u jdbcdriver | grep "SpyAttribute"

• generic web:

curl 'jdbc_endpoint/?SpyAttribute=malicious_code' -v | grep 'SpyAttribute='

• database (mysql, redis, mongodb, postgresql): While this is a JDBC driver vulnerability, check for unusual JDBC connection strings in configuration files.

-- (Example - MySQL) - Inspect connection string for SpyAttribute
SHOW VARIABLES LIKE 'jdbc_connection_string';

1. 2025-11-19Disclosure

   disclosure

2. 2025-11-19Patch

   patch

1. Réservé2025-09-18
2. Publiée2025-11-19
3. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade to a patched version of the DataDirect JDBC drivers. Progress has released a fix on 2025-11-19; ensure your environment is updated to this version or later. As a temporary workaround, if upgrading is not immediately feasible, consider disabling the SpyAttribute option entirely if it is not essential for your application's functionality. Review your application's code to ensure that any user-supplied data used in constructing JDBC connection strings is properly validated and sanitized. Implement Web Application Firewall (WAF) rules to block requests containing suspicious patterns in the SpyAttribute parameter.