SQL Injection via Column Name Validation in Alibaba DataX RDBMS Writer

# SQL Injection via Column Name Validation in Alibaba DataX RDBMS Writer

---

## Affected Product

* **Vendor**: Alibaba Group
* **Product**: DataX
* **Component**: RDBMS Writer (plugin-rdbms-util)
* **Affected Versions**: <=2023.09

---

## 3. Vulnerability Type

* **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

---

## 4. CVE Description

> Alibaba DataX contains a SQL injection vulnerability in the RDBMS writer component.
> Specifically, the method `DBUtil.getColumnMetaData()` constructs a SQL query by directly concatenating user-controlled column names into a SELECT statement without validation or sanitization.
>
> An attacker who can modify job configuration files may inject malicious SQL expressions into the column list, leading to arbitrary SQL execution during the validation phase.
>
> This vulnerability affects all RDBMS writer plugins and may result in unauthorized data access, database enumeration, or data exfiltration, depending on database privileges.

---

## 5. Attack Vector

* **Attack Complexity**: Low
* **Privileges Required**: Low (ability to submit or modify DataX job configuration)
* **User Interaction**: None
* **Scope**: Unchanged
* **Vector**: Local / Adjacent (depends on deployment model)

---
---

## 7. Technical Details

### Vulnerable Code

```java
String queryColumnSql = "select " + column + " from " + tableName + " where 1=2";
rs = statement.executeQuery(queryColumnSql);
```

### Root Cause

* User-controlled input (`column`) is directly concatenated into SQL
* No validation of column identifiers
* Use of `Statement` instead of safe query construction
* Misuse of SQL execution for schema validation

---

## 8. Exploitation Conditions

An attacker can exploit this vulnerability if:

1. They can modify or supply a DataX job configuration
2. The configuration includes a malicious `column` field
3. DataX executes the job and performs column validation

---

## 9. Impact

Successful exploitation may allow:

* Execution of arbitrary SQL expressions within the database context
* Extraction of sensitive data via subqueries or error-based techniques
* Database schema enumeration
* Potential data modification depending on database configuration

**Note**:
Stacked queries are database/driver dependent and not required for exploitation.

---

## 10. Proof of Concept

```json
{
"column": [
"id",
"(SELECT user()) AS injected"
]
}
```

Resulting query:

```sql
SELECT id, (SELECT user()) AS injected FROM table WHERE 1=2
```

---

## 11. Remediation

Recommended fixes include:

1. **Strict validation of column identifiers**, e.g.:

```
^[a-zA-Z_][a-zA-Z0-9_]*$
```

2. **Use database metadata APIs** instead of executing SQL:

```java
DatabaseMetaData.getColumns(...)
```

3. **Reject any column containing SQL expressions or special characters**

4. Apply **principle of least privilege** to database accounts used by DataX

---

## 12. Discovery Information

* **Discovered by**: Security Auditor Agent
* **Discovery Date**: 2026-03-24
* **Disclosure Status**: Coordinated disclosure recommended

---

## 13. References

* CWE-89: [https://cwe.mitre.org/data/definitions/89.html](https://cwe.mitre.org/data/definitions/89.html)
* OWASP SQL Injection Cheat Sheet

Start with DBUtil.getColumnMetaData() in the plugin-rdbms-util RDBMS writer component and inspect how the column list reaches the constructed SELECT statement. Define completion as preventing SQL expressions or special characters in configured columns from reaching execution, while preserving validation for all affected RDBMS writer plugins; the payload does not name a test file.

Written by the indexing model from the issue text.