DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
The DataSourceResource.java file, responsible for handling data sources within the SpagoBI API, does not verify whether the provided JNDI name begins with the required prefix 'java:comp/env/jdbc/'. The absence of this validation allows an attacker to provide any JNDI path, including one pointing to an external or malicious JNDI server. As a result, the server may be forced to load and execute code from an external source, which is a classic Resource Injection attack vector.
An attacker with access to the API interface with high-level permissions can gain full control over the server, including access to sensitive data, ability to modify configuration, and potential remote code execution (RCE) through a substituted JNDI resource.
Update Knowage Server to version 8.1.30 or later. The fix was introduced in commit f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c available in the official project repository on GitHub.
Knowage Server in all versions before 8.1.30
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H