Data Leakage via Chart Data API in DataEase

Detection Guidance

This vulnerability involves unauthorized data access through manipulation of the POST /de2api/chartData/getData request body, where tableId and field IDs can be replaced to access unshared datasets despite having a valid share link token.

To detect exploitation attempts on your network or system, you should monitor and analyze POST requests to the /de2api/chartData/getData endpoint for unusual or unauthorized tableId and field ID values that do not correspond to the shared resource linked to the sceneId.

Suggested commands include using network traffic inspection tools like tcpdump or Wireshark to capture HTTP POST requests, or using command-line tools such as curl or httpie to manually test and verify if the server improperly accepts manipulated tableId and field IDs.

• Use tcpdump to capture traffic on port 80 or 443 and filter for POST requests to /de2api/chartData/getData: tcpdump -A -s 0 'tcp port 80 or 443 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'POST /de2api/chartData/getData'
• Use curl to send a crafted POST request with modified tableId and field IDs to test if unauthorized data is returned: curl -X POST https://yourserver/de2api/chartData/getData -H 'Authorization: Bearer <valid_share_token>' -d '{"sceneId":"<valid_sceneId>","tableId":"<unauthorized_tableId>","fieldIds":["<unauthorized_fieldId>"]}'
• Review server logs for POST requests to /de2api/chartData/getData with mismatched sceneId and tableId or field IDs.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. The issue is that the share mode chart data interface only checks if the sceneId matches the resourceId in the link token but does not verify whether the tableId and field IDs in the request body actually belong to the shared resource.

Because of this insufficient validation, an attacker who has a valid share link token can manipulate the dataset identifiers in the request to access unauthorized data by sending a POST request to /de2api/chartData/getData.

This vulnerability was fixed in version 2.10.24.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with a valid share link token to bypass intended data access restrictions and retrieve unauthorized data by altering dataset identifiers in requests.

This can lead to data leakage, exposing sensitive or confidential information that should not be accessible to the attacker.

Such unauthorized data access can compromise the confidentiality and integrity of your data, potentially causing harm to your organization or users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade DataEase to version 2.10.24 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with a valid share link token to retrieve unauthorized data by manipulating dataset identifiers. Such unauthorized data access can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on data access and confidentiality.

Because the vulnerability enables exposure of data beyond authorized scopes, it may result in non-compliance with standards that mandate data access restrictions and protection of sensitive information.

Useful 0 Not Useful 0