SQL Injection in DataEase via Unauthorized SQL Preview

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. The issue is that the /de2api/datasetData/previewSql endpoint does not have the required @DePermit permission validation annotation. As a result, any authenticated user can specify datasourceId=-1 to access the built-in engine database, execute arbitrary SQL statements, and read sensitive core data.

This vulnerability allows unauthorized access to sensitive data and arbitrary SQL execution within the application.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have serious impacts including unauthorized access to sensitive core data and the ability for an attacker to execute arbitrary SQL commands on the built-in engine database.

This could lead to data breaches, data manipulation, or disruption of the application’s normal operation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user to execute arbitrary SQL statements and read sensitive core data without proper permission validation. This unauthorized access to sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

By enabling unauthorized data access, the vulnerability undermines compliance with standards that mandate confidentiality, integrity, and controlled access to sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade DataEase to version 2.10.24 or later, where the issue is fixed.

Ensure that the /de2api/datasetData/previewSql endpoint enforces the @DePermit permission validation annotation to prevent unauthorized access.

Useful 0 Not Useful 0