Executive Summary

This vulnerability is a SQL injection issue found in DataEase, an open-source data visualization and analytics platform. Specifically, versions 2.10.20 and below have a flaw in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The service layer directly uses the user-supplied sort value without validating it against a whitelist, which allows an authenticated attacker to inject arbitrary SQL commands. This injection occurs in the ORDER BY clause of a SQL query, enabling time-based blind SQL injection attacks.

Useful 0 Not Useful 0

Impact Analysis

An attacker who is authenticated can exploit this vulnerability to execute arbitrary SQL commands on the database. This can lead to unauthorized data access, data manipulation, or denial of service. Because the injection is time-based blind SQL injection, the attacker can infer information from the database even if direct output is not returned, potentially compromising sensitive data and the integrity of the system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in DataEase version 2.10.21. Immediate mitigation involves upgrading your DataEase installation to version 2.10.21 or later.

Since the issue is a SQL injection via the sort parameter in the /de2api/datasetData/enumValueObj endpoint, restricting or validating input to this parameter can help mitigate risk until the upgrade is applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a SQL injection in the sort parameter of the /de2api/datasetData/enumValueObj endpoint in DataEase versions 2.10.20 and below. Detection typically involves testing this endpoint with crafted inputs to identify if SQL injection is possible.

Since the vulnerability is a time-based blind SQL injection, one common detection method is to send requests with payloads that cause a delay in the response if the injection is successful.

Example commands to test this could include using curl or a similar HTTP client to send requests with injected SQL payloads in the sort parameter and observe response times.

• curl -X GET 'http://<target>/de2api/datasetData/enumValueObj?sort=1 OR IF(SLEEP(5),1,0)-- ' -H 'Authorization: Bearer <token>'
• curl -X GET 'http://<target>/de2api/datasetData/enumValueObj?sort=1 ORDER BY CASE WHEN (SELECT IF(1=1,SLEEP(5),0)) THEN 1 ELSE 2 END-- ' -H 'Authorization: Bearer <token>'

If the response is delayed significantly (e.g., by 5 seconds), it indicates the presence of a time-based blind SQL injection vulnerability.

Note: These commands require authentication since the vulnerability requires an authenticated attacker.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a SQL injection in the DataEase platform that allows an authenticated attacker to execute arbitrary SQL commands. Such vulnerabilities can lead to unauthorized access or manipulation of sensitive data.

While the provided information does not explicitly mention compliance impacts, SQL injection vulnerabilities generally pose risks to data confidentiality and integrity, which are critical aspects of standards like GDPR and HIPAA.

Therefore, exploitation of this vulnerability could potentially lead to non-compliance with regulations that require protection of personal and sensitive data.

Useful 0 Not Useful 0