CVE-2025-53005: Jdbc Url Denylist Contains Bypass

JDBC URL validation uses URLDecoder.decode(...).contains(...) against a denylist of dangerous parameter names. This check is case-sensitive and easily bypassed with case-shifted parameter names (e.g., SSLFactory vs sslfactory) that JDBC drivers still honor, enabling parameters like sslfactory/sslfactoryarg to load attacker-controlled classes (CVE-2025-53005)

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0java
greprules fetch cve-2025-53005-jdbc-url-denylist-contains-bypass --engine opengrep

Description

JDBC URL validation uses URLDecoder.decode(...).contains(...) against a denylist of dangerous parameter names. This check is case-sensitive and easily bypassed with case-shifted parameter names (e.g., SSLFactory vs sslfactory) that JDBC drivers still honor, enabling parameters like sslfactory/sslfactoryarg to load attacker-controlled classes (CVE-2025-53005)

Detection target

Not provided

Recommended fix

Not provided

False-positive notes

Not provided

Community feedback

Sign in to report false positives, mark this rule useful, or suggest metadata improvements.