Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.

Affected: Maven: io.dataease:dataease-plugin-common

### Impact

In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. 

In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, MysqlConfiguration class don't filter any parameters, directly concat user input. ```java @Getter @Setter public class MysqlConfiguration extends JdbcConfiguration {

private String driver = "com.mysql.jdbc.Driver"; private String extraParams = "characterEncoding=UTF-8&connectTimeout=5000&useSSL=false&allowPublicKeyRetrieval=true&zeroDateTimeBehavior=convertToNull";

public String getJdbc() { if(StringUtils.isEmpty(extraParams.trim())){ return "jdbc:mysql://HOSTNAME:PORT/DATABASE" .replace("HOSTNAME", getHost().trim()) .replace("PORT", getPort().toString().trim()) .replace("DATABASE", getDataBase().trim()); }else { return "jdbc:mysql://HOSTNAME:PORT/DATABASE?EXTRA_PARAMS" .replace("HOSTNAME", getHost().trim()) .replace("PORT", getPort().toString().trim()) .replace("DATABASE", getDataBase().trim()) .replace("EXTRA_PARAMS", getExtraParams().trim()); } } } ``` So, if the attack add some parameters in J…