A directory traversal vulnerability in Datart 1.0.0-rc.3 allows unauthenticated attackers to achieve remote code execution through unsafe YAML deserialization.

The application is susceptible to directory traversal which permits the upload of arbitrary YAML files to the config/jdbc-driver-ext.yml path. This file is subsequently parsed using unsafe SnakeYAML methods, enabling unauthenticated remote attackers to trigger arbitrary class instantiation and potentially execute code.

The ability for an unauthenticated attacker to execute arbitrary code on the server represents the highest level of security risk. With a CVSS score of 8.8, this flaw could lead to full system compromise, exfiltration of sensitive database connection strings, or total loss of data integrity. Such an incident would likely result in severe operational downtime and significant reputational damage.

Immediate Action: Since no official patch is currently confirmed, administrators should restrict access to the application configuration endpoints and disable any features that allow the upload of YAML configuration files.

Proactive Monitoring: Monitor server logs for unusual file upload activity or attempts to access or modify files within the config directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing suspicious directory traversal patterns or unauthorized attempts to access YAML-based configuration paths.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a critical threat to the integrity of the Datart environment. Organizations should prioritize isolating affected instances from external networks until a vendor-supplied patch is released and verified. Continuous vigilance and the application of strict input validation remain the best defenses against this class of deserialization attack.