Apache Linkis: ダブルURLエンコーディングによる任意のファイル読み込みの回避

An attacker can exploit this vulnerability by crafting a malicious JDBC URL with multiple rounds of URL encoding. This bypasses Linkis's intended security checks, allowing the attacker to specify arbitrary file paths. Successful exploitation could lead to the disclosure of sensitive system files, including configuration data, credentials, or even executable code. The potential blast radius extends to any system accessible through the Linkis JDBC engine, and the impact could be significant depending on the data exposed. This vulnerability highlights the importance of proper input validation and sanitization, particularly when handling user-supplied data in JDBC connections.

Organizations deploying Apache Linkis for data processing and analytics are at risk, particularly those relying on the JDBC engine for connecting to external data sources. Environments with legacy Linkis installations (versions 1.3.0 - 1.7.0) are especially vulnerable, as are those with complex JDBC configurations or inadequate input validation.

• java / server:

find /opt/linkis/logs -type f -name "*.log" | grep -i "JDBC URL contains multiple encoded characters"

• generic web:

curl -I <linkis_jdbc_url_endpoint> | grep -i "URL-encoded characters"

1. 2026-01-19Disclosure

   disclosure

1. 予約済み2025-03-12
2. 公開日2026-01-19
3. 更新日2026-02-03
4. EPSS 更新日2026-03-23

The primary mitigation is to upgrade Apache Linkis to version 1.8.0 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, a temporary workaround involves implementing stricter checks on JDBC connection URLs. Specifically, the Linkis system should continuously check for the presence of the '%' character in the connection information. If found, perform URL decoding to reveal any potentially malicious characters. Consider implementing a Web Application Firewall (WAF) rule to block requests containing excessively encoded URLs. After upgrading, confirm the fix by attempting to connect with a crafted URL containing multiple encoded characters; the connection should be rejected.