Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2024-49194

High
7.3/10

Summary

Databricks JDBC Driver versions prior to 2.6.40 could potentially allow Remote Code Execution (RCE) by triggering a JNDI Injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the "krbJAASFile" parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property "krbJAASFile".

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • NONE

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published