CVE-2024-56511

The class `io.dataease.auth.filter.TokenFilter` retrieves the request URL using the `request.getRequestURI` method and passes it to the `WhitelistUtils.match` method, which checks whether the given endpoint requires authentication. The `match` method filters semicolons; however, this filtering is insufficient. When an administrator configures a custom value for `server.servlet.context-path`, an attacker can construct a request with a path prefix in the form `/geo/../context-path/`, which causes the whitelist matching mechanism to incorrectly classify the request as not requiring authentication (path traversal using the `..` sequence). As a result, any endpoint in the application becomes accessible without providing a valid token.

An unauthenticated remote attacker can gain unauthorized access to protected API interfaces of the application, which may lead to disclosure, modification, or destruction of stored data.

DataEase should be updated to version 2.10.4 or later, in which the vulnerability has been removed. Producer references: https://github.com/dataease/dataease/security/advisories/GHSA-9f69-p73j-m73x

DataEase in versions prior to 2.10.4, with the risk of authentication bypass occurring particularly in installations with a custom `server.servlet.context-path` parameter configuration.