Unauthenticated Token Exposure in DataEase via ProxyInfo

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. The issue is with the /de2api/share/proxyInfo share interface, which generates and returns an X-DE-LINK-TOKEN before validating the share password or ticket. This means that an unauthenticated attacker who knows a protected share UUID can obtain a valid link token without providing valid credentials.

The valid link token can then be used for subsequent share-related API calls, potentially allowing unauthorized access to shared data.

This vulnerability was fixed in version 2.10.24.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthenticated attackers to bypass authentication controls by obtaining a valid link token without proper credentials. This can lead to unauthorized access to shared data or resources within the DataEase application.

Such unauthorized access could result in data exposure, data leakage, or manipulation of shared information, depending on what the attacker can do with the API calls using the stolen token.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade DataEase to version 2.10.24 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to obtain a valid link token for share-related API calls without proper credential validation. This could lead to unauthorized access to protected data.

Such unauthorized access risks violating data protection requirements under regulations like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive data.

Therefore, this vulnerability potentially compromises compliance with these standards by exposing data to unauthorized parties.

Useful 0 Not Useful 0