CVE-2024-49194: Databricks JDBC Driver JNDI injection vulnerability
A vulnerability in Databricks JDBC Driver versions 2.6.38 and below could allow remote code execution through JNDI injection via a specially crafted connection URL. The vulnerability was discovered through the Databricks bug bounty program and has been patched in version 2.6.40 and above.
What happened
A vulnerability in the Databricks JDBC Driver could allow remote code execution by triggering a JNDI injection via the krbJAASFile JDBC URL parameter.
The vulnerability was reported via the Databricks bug bounty program and assigned CVE-2024-49194 with a CVSS severity of 7.3.
Reported impact
An attacker could potentially exploit this vulnerability to gain remote code execution in the context of the driver by tricking a victim to use a specially crafted connection URL.
Index analysis
The vulnerability is rooted in improper handling of the krbJAASFile parameter, which could allow arbitrary deserialization via JNDI.
Governance controls
The Databricks JDBC Driver version 2.6.40 and above fully resolves the issue. All current versions of Databricks Runtime on Databricks compute and serverless compute have already been patched and/or mitigated.
If users cannot update the JDBC driver, they can update JVM configuration by setting com.sun.jndi.ldap.object.trustURLCodebase and com.sun.jndi.ldap.object.trustSerialData to false.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.