Path Traversal in DataEase Prior to 2.10.24

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. It involves the font management module, where authenticated users can submit an arbitrary fileTransName when creating a font record.

When the font record is deleted, the backend concatenates the stored fileTransName value with the font storage directory and passes it to FileUtils.deleteFile() without sanitizing for path traversal. This allows an attacker to delete arbitrary writable files within the application container.

The issue is fixed in version 2.10.24.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user to delete arbitrary writable files in the application container.

Such unauthorized file deletions can lead to data loss, disruption of application functionality, and potential denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade DataEase to version 2.10.24 or later, where the issue has been fixed.

Until the upgrade is applied, restrict authenticated users' permissions to prevent them from creating or deleting font records, as the vulnerability requires authenticated access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to delete arbitrary writable files in the application container due to a path traversal flaw in the font management module. This can lead to data loss or service disruption.

Such unauthorized file deletion could impact compliance with standards and regulations like GDPR or HIPAA, which require protection of data integrity and availability. If critical files containing personal or sensitive data are deleted, it may result in violations of these regulations.

Therefore, this vulnerability poses a risk to maintaining compliance with data protection and security requirements mandated by common standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user submitting a crafted fileTransName value that leads to path traversal and arbitrary file deletion when a font record is deleted. Detection involves monitoring for suspicious or unexpected file deletion activities within the font storage directory or outside it.

To detect exploitation attempts, you can audit logs for deletion operations targeting files outside the expected font directory or containing path traversal patterns (e.g., ../).

Suggested commands to help detect potential exploitation attempts include:

• Check recent deletions in the font directory and suspicious deletions outside it using filesystem audit tools or commands like: `find /path/to/font/storage -type f -mtime -7 -exec ls -l {} \;` to list recently modified or deleted files.
• Search application logs for deletion requests containing suspicious fileTransName values with path traversal patterns: `grep -r "fileTransName" /path/to/dataease/logs | grep "\.\./"`
• If auditd is enabled, review audit logs for file deletion events outside the font directory: `ausearch -f /path/to/font/storage` or `ausearch -f /etc/passwd` (or other critical files) to detect unauthorized deletions.

Since the vulnerability requires authentication, monitoring authenticated user actions related to font record deletions can also help detect exploitation.

Useful 0 Not Useful 0