CVE-2023-37258

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

A flaw was found in DataEase up to version 3.0.0 in the Utils.buildCalcField function of the file io/dataease/engine/utils/Utils.java. Manipulation of the calculated field argument causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A directory traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a crafted request to the StaticResourceController.java component.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another. The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.

A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.