コード生成の不適切な制御 ('Code Injection') の脆弱性により、Progress DataDirect Connect for JDBC ドライバ、Progress DataDirect Open Access JDBC ドライバ、および Hybrid Data Pipeline でリモートコード実行が可能になっています。 DataDirect Connect for JDBC ドライバ、DataDirect Hybrid Data Pipeline JDBC ドライバ、および DataDirect OpenAccess JDBC ドライバによって実装されている SpyAttribute 接続オプションは、オプション値に対して文書化されていない構文構造をサポートしており、発見されると攻撃者が利用できる可能性があります。

The vulnerability lies in the improper handling of the SpyAttribute connection option. This option, intended for debugging and monitoring purposes, contains an undocumented syntax that attackers can exploit. By crafting malicious input for this option, an attacker can inject and execute arbitrary code on the server hosting the JDBC driver. This could lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of persistent malware. The blast radius extends to any application utilizing these JDBC drivers, particularly those allowing user-controlled input to influence connection parameters. This is similar in concept to other JDBC injection vulnerabilities where improperly sanitized connection strings are exploited.

Applications utilizing Progress DataDirect JDBC drivers, particularly those deployed in environments where user-supplied data is used to configure JDBC connections, are at risk. Shared hosting environments where multiple applications share the same JDBC driver instance are especially vulnerable, as a compromise in one application could potentially affect others.

• linux / server:

journalctl -u jdbcdriver | grep "SpyAttribute"

• generic web:

curl 'jdbc_endpoint/?SpyAttribute=malicious_code' -v | grep 'SpyAttribute='

• database (mysql, redis, mongodb, postgresql): While this is a JDBC driver vulnerability, check for unusual JDBC connection strings in configuration files.

-- (Example - MySQL) - Inspect connection string for SpyAttribute
SHOW VARIABLES LIKE 'jdbc_connection_string';

1. 2025-11-19Disclosure

   disclosure

2. 2025-11-19Patch

   patch

1. 予約済み2025-09-18
2. 公開日2025-11-19
3. EPSS 更新日2026-03-23

The primary mitigation is to upgrade to a patched version of the DataDirect JDBC drivers. Progress has released a fix on 2025-11-19; ensure your environment is updated to this version or later. As a temporary workaround, if upgrading is not immediately feasible, consider disabling the SpyAttribute option entirely if it is not essential for your application's functionality. Review your application's code to ensure that any user-supplied data used in constructing JDBC connection strings is properly validated and sanitized. Implement Web Application Firewall (WAF) rules to block requests containing suspicious patterns in the SpyAttribute parameter.