Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

Vulnerability

Description

CVE-2025-27528 is a deserialization of untrusted data vulnerability in Apache InLong's JDBC component. The root cause lies in improper handling of special characters within JDBC URLs, which allows an attacker to bypass the built-in security mechanisms [1][4]. This flaw affects all versions from 1.13.0 through 2.1.0.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious JDBC URL containing invisible or special characters that are not properly sanitized. This bypasses the security checks intended to restrict JDBC operations, enabling the attacker to execute arbitrary file read operations on the server [2]. The exploitation does not require authentication, but the attacker must have the ability to supply a JDBC URL to the InLong system.

Impact

Successful exploitation leads to arbitrary file reading, potentially exposing sensitive data such as configuration files, credentials, or other confidential information stored on the server [1][4]. This could serve as a stepping stone for further attacks.

Mitigation

Users are advised to upgrade to Apache InLong version 2.2.0, which contains the fix. Alternatively, the patch can be cherry-picked from the official pull request [2]. No workarounds have been provided for older versions.