DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.
The vulnerability results from the use of a static, hardcoded secret used to sign JWT tokens (CWE-798 — use of hardcoded credentials). Since the secret is embedded directly in the source code, an attacker can read it and independently generate any correctly signed JWT token. Additionally, hardcoded UID and OID values facilitate the construction of tokens impersonating privileged users. A remote, unauthenticated attacker can thus gain access to the service with the privileges of any account.
An attacker can forge a JWT token and take full control of the DataEase service, gaining unauthorized access to data and administrative functions. The confidentiality and integrity of stored data is compromised.
DataEase should be updated to version 2.10.2 or later, in which the vulnerability has been fixed. The patch is available in the project repository (commit e755248d59543bcd668ace495f293ff735fa82e9).
DataEase in versions prior to 2.10.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDataease
APPDataease< 2.10.2
Related vulnerabilities
Dataease: RCE poprzez path traversal w parametrze IniFile sterownika JDBC
SQL Injection w Dataease — niekontrolowany parametr tabeli w podglądzie danych
RCE w DataEase v1 poprzez komponenty konta użytkownika i hasła
DataEase – obejście uwierzytelnienia przez path traversal w TokenFilter
DataEase: brak weryfikacji podpisu JWT umożliwia dostęp do dowolnego interfejsu