Description

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T00:16:28.810Z",
  "pubdate": "2026-08-19T00:16:28.810Z",
  "executiveSummary": "A permission-related security vulnerability has been identified in the xianrendzw EasyReport application up to version 2.0.17.0522_Beta. The flaw specifically resides within the DataSourceController.add function located in the DataSourceController.java file of the QueryerFactory component. This security deficiency arises from improper handling and manipulation of the queryerClass argument during data source configuration and creation processes. Remote attackers can exploit this vulnerability without prior authentication to bypass intended authorization checks, leading to unauthorized access and permission enforcement issues within the application architecture. The public disclosure of the exploit vector, combined with the vendor's lack of response to early issue reports, significantly elevates the risk posture for deployed instances. Threat actors possessing network access can leverage this flaw to interact with restricted backend functionalities, potentially compromising the confidentiality, integrity, and availability of the underlying reporting infrastructure. Immediate defensive actions are warranted to restrict exposure and monitor for unauthorized interaction with the vulnerable endpoint.",
  "technicalDetails": "The vulnerability is fundamentally rooted in inadequate access control validation and improper input sanitization within the DataSourceController.add function inside the DataSourceController.java file of the QueryerFactory component in xianrendzw EasyReport up to version 2.0.17.0522_Beta. Specifically, the application fails to adequately validate or restrict the values supplied to the queryerClass argument during execution paths handling data source definitions. Because the software dynamically processes this parameter without enforcing rigorous privilege and authorization boundaries, remote unauthorized users can manipulate the argument to invoke unintended operational states or bypass administrative security controls.\nThe attack flow initiates when a remote attacker crafts a malicious HTTP request directed at the vulnerable endpoint mapped to the DataSourceController.add function. The attacker includes a manipulated or unauthorized payload within the queryerClass parameter. Upon receipt, the QueryerFactory component processes the supplied class reference without performing sufficient validation against the caller's authorization context. This improper handling allows the execution flow to instantiate or interact with queryer classes that should otherwise be restricted based on user privilege levels.\nNetwork exposure is fully remote over standard web protocols, requiring no physical access to the host infrastructure. Based on the disclosed characteristics, the attack does not mandate prior authentication, lowering the barrier to entry for potential threat actors. The post-exploitation impact includes the potential exposure of sensitive database configurations, unauthorized data querying capabilities, or further systemic compromise depending on the privileges assigned to the underlying application runtime and the capabilities exposed by the manipulated queryer classes. As the vendor has not yet responded or issued an official patch, the vulnerability remains actively exploitable in all affected versions up to 2.0.17.0522_Beta."
}