CVE-2023-37258

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.

A vulnerability in DataEase before version 2.10.23 allows arbitrary SQL read queries on connected datasources. The SQL preview function does not enforce table access restrictions.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.

In DataEase prior to version 2.10.23, SQL-type datasets store attacker-controlled SQL variable default values such as ${var}, and SqlparserUtils.handleVariableDefaultValue() inserts them using String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset.

In DataEase prior to version 2.10.23, a vulnerability was found in the bulk delete API endpoint where path traversal sequences like ../ are not sanitized. Attackers can delete arbitrary server directories through the export task cleanup mechanism.

In DataEase prior to version 2.10.23, a vulnerability was found due to insufficient path validation in template saving endpoints. An attacker can use attacker-controlled static resource names and Base64 content to perform path traversal and arbitrary file writes on the server.