Onjuiste controle over de generatie van code ('Code Injection') kwetsbaarheid in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver en Hybrid Data Pipeline maakt Remote Code Inclusion mogelijk. De SpyAttribute verbindingsoptie geïmplementeerd door de DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver en de DataDirect OpenAccess JDBC driver ondersteunt een ongedocumenteerde syntaxisconstructie voor de optiewaarde die, indien ontdekt, door een aanvaller gebruikt kan worden.

The vulnerability lies in the improper handling of the SpyAttribute connection option. This option, intended for debugging and monitoring purposes, contains an undocumented syntax that attackers can exploit. By crafting malicious input for this option, an attacker can inject and execute arbitrary code on the server hosting the JDBC driver. This could lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of persistent malware. The blast radius extends to any application utilizing these JDBC drivers, particularly those allowing user-controlled input to influence connection parameters. This is similar in concept to other JDBC injection vulnerabilities where improperly sanitized connection strings are exploited.

Applications utilizing Progress DataDirect JDBC drivers, particularly those deployed in environments where user-supplied data is used to configure JDBC connections, are at risk. Shared hosting environments where multiple applications share the same JDBC driver instance are especially vulnerable, as a compromise in one application could potentially affect others.

• linux / server:

journalctl -u jdbcdriver | grep "SpyAttribute"

• generic web:

curl 'jdbc_endpoint/?SpyAttribute=malicious_code' -v | grep 'SpyAttribute='

• database (mysql, redis, mongodb, postgresql): While this is a JDBC driver vulnerability, check for unusual JDBC connection strings in configuration files.

-- (Example - MySQL) - Inspect connection string for SpyAttribute
SHOW VARIABLES LIKE 'jdbc_connection_string';

1. 2025-11-19Disclosure

   disclosure

2. 2025-11-19Patch

   patch

1. Gereserveerd2025-09-18
2. Gepubliceerd2025-11-19
3. EPSS bijgewerkt2026-03-23

The primary mitigation is to upgrade to a patched version of the DataDirect JDBC drivers. Progress has released a fix on 2025-11-19; ensure your environment is updated to this version or later. As a temporary workaround, if upgrading is not immediately feasible, consider disabling the SpyAttribute option entirely if it is not essential for your application's functionality. Review your application's code to ensure that any user-supplied data used in constructing JDBC connection strings is properly validated and sanitized. Implement Web Application Firewall (WAF) rules to block requests containing suspicious patterns in the SpyAttribute parameter.