CVE-2023-40772

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another. The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.

A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.

A vulnerability in DataEase before version 2.10.23 allows arbitrary SQL read queries on connected datasources. The SQL preview function does not enforce table access restrictions.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.