Data Leakage via Chart Data API in DataEase

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. The issue is that the share mode chart data interface only checks if the sceneId matches the resourceId in the link token but does not verify whether the tableId and field IDs in the request body actually belong to the shared resource.

Because of this insufficient validation, an attacker who has a valid share link token can manipulate the dataset identifiers in the request to access unauthorized data by sending a POST request to /de2api/chartData/getData.

This vulnerability was fixed in version 2.10.24.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with a valid share link token to bypass intended data access restrictions and retrieve unauthorized data by altering dataset identifiers in requests.

This can lead to data leakage, exposing sensitive or confidential information that should not be accessible to the attacker.

Such unauthorized data access can compromise the confidentiality and integrity of your data, potentially causing harm to your organization or users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade DataEase to version 2.10.24 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with a valid share link token to retrieve unauthorized data by manipulating dataset identifiers. Such unauthorized data access can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on data access and confidentiality.

Because the vulnerability enables exposure of data beyond authorized scopes, it may result in non-compliance with standards that mandate data access restrictions and protection of sensitive information.

Useful 0 Not Useful 0