An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.
The vulnerability classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code) involves the JDBC driver failing to properly validate class names passed from external sources when parsing connection URL parameters. Under certain conditions, the driver dynamically loads and executes the class specified by the attacker. The prerequisite for a successful attack is the availability of an appropriate class on the application's classpath (a so-called gadget class), which limits exploitability but does not eliminate the risk in typical server environments.
An attacker who can control the JDBC connection URL parameters can achieve arbitrary code execution in the context of the application process, which in practice may mean complete takeover of the application and access to the data it processes.
Update Amazon Redshift JDBC Driver to version 2.2.2 or later. The package is available in the vendor's GitHub repository: https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2. Additionally, it is recommended to restrict the ability to modify JDBC connection URLs by unauthorized parties and review the application's classpath for the presence of classes potentially vulnerable to abuse.
Amazon Redshift JDBC Driver in versions prior to 2.2.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X