github.comConfirmation
https://github.com/dataease/dataease/security/advisories/GHSA-9f69-p73j-m73x CVE-2024-56511
CRITICALNuclei
DataEase has an unauthorized vulnerability
Record summary
CVE-2024-56511 has a selected CVSS score of 9.3 (critical); EIP currently links 1 Nuclei template.
Description
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the "WhitelistUtils.match" method to determine whether the URL request is an interface that does not require authentication. The "match" method filters semicolons, but this is not enough. When users set "server.servlet.context-path" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 10, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
dataeaseBrowse dataease / dataease | CVE List | < 2.10.4 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALDataEase < 2.10.4 - Authentication Bypass via Whitelist Path TraversalCVSS 9.8
DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.
Impact
An unauthenticated attacker can reach every `/de2api` endpoint as if authenticated, exposing user management, datasource configuration, dashboards, and exports. Chained with CVE-2025-32966 (H2 JDBC RCE) the bypass becomes pre-auth remote code execution.
Remediation
Upgrade to DataEase 2.10.4 or later, which normalizes the request path before whitelist matching.
WeaknessesCWE-289
AuthorsChrisJr404
Template tagscvecve2024dataeaseauth-bypasstraversal
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shodan: http.title:"DataEase"
FOFA: title="DataEase"
https://github.com/dataease/dataease/security/advisories/GHSA-9f69-p73j-m73x https://nvd.nist.gov/vuln/detail/CVE-2024-56511
Source: ProjectDiscovery