DataEase vulnerabilities

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.

A vulnerability in DataEase before version 2.10.23 allows arbitrary SQL read queries on connected datasources. The SQL preview function does not enforce table access restrictions.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.

In DataEase prior to version 2.10.23, SQL-type datasets store attacker-controlled SQL variable default values such as ${var}, and SqlparserUtils.handleVariableDefaultValue() inserts them using String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset.

In DataEase prior to version 2.10.23, a vulnerability was found in the bulk delete API endpoint where path traversal sequences like ../ are not sanitized. Attackers can delete arbitrary server directories through the export task cleanup mechanism.

In DataEase prior to version 2.10.23, a vulnerability was found due to insufficient path validation in template saving endpoints. An attacker can use attacker-controlled static resource names and Base64 content to perform path traversal and arbitrary file writes on the server.

In DataEase prior to version 2.10.23, a SQL injection vulnerability was found in the datasource connection status check function. An attacker can exploit the schema parameter in the SQL query, leading to unauthorized data access.

In DataEase prior to version 2.10.23, a SQL injection vulnerability was found. Dashboard SQL variables like ${deptId} are processed by SqlparserUtils.transFilter(), which returns raw user input for operators other than 'in' and 'between', and then spliced into the dashboard SQL without proper sanitization. This allows authenticated users with dashboard access to inject malicious SQL into integrated datasources.

In DataEase prior to version 2.10.24, a vulnerability exists due to a hardcoded default share link signature key. An attacker who knows this key (link-pwd-fit2cloud) can forge JWT tokens and access backend resources as the share creator, even after the original share has been revoked.

In DataEase prior to version 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard.

In DataEase before version 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources.

In DataEase prior to version 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution.

In DataEase prior to version 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container.

In DataEase prior to version 2.10.24, a vulnerability allows bypassing H2 database JDBC URL validation using special Unicode characters with different case-conversion behavior. Attackers can smuggle dangerous parameters like init in malicious JDBC strings, leading to arbitrary code execution.

In DataEase before version 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation, allowing any authenticated user to execute arbitrary SQL statements on the built-in engine database and read sensitive core data.

In DataEase before version 2.10.24, an authenticated user can download, delete, retry, or generate download links for export tasks belonging to other users by manipulating the task ID parameter. Additionally, the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files.

In DataEase prior to version 2.10.24, the share mode chart data interface fails to validate whether tableId and field IDs in the request belong to the shared resource. An attacker with a valid share link token can replace dataset identifiers and retrieve unauthorized data via the POST /de2api/chartData/getData endpoint.

In DataEase before version 2.10.24, the /de2api/share/proxyInfo share interface generates and returns the X-DE-LINK-TOKEN before validating the share password or ticket. This allows unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials.

DataEase is a data visualization analysis tool that prior to version 1.18.9 had a SQL injection vulnerability allowing bypass of blacklists. The vulnerability has been fixed in version 1.18.9.

DataEase is a data visualization analysis tool that, in affected versions, has a missing authorization check. This allows unauthorized users to manipulate dashboards created by the administrator.

DataEase, a data visualization analysis tool, has a privilege bypass vulnerability that allows ordinary users to access the user database. Exposed information includes md5 hashes of passwords, usernames, email addresses, and phone numbers.

DataEase is a data visualization analysis tool that in affected versions allows unauthorized users to delete an application. This vulnerability has been fixed in version 1.18.8.