Stored XSS in DataEase Dashboard Components

Executive Summary

This vulnerability exists in DataEase, an open source data visualization and analysis tool, in versions prior to 2.10.24. The issue arises because dashboard text components render stored content using Vue's v-html directive without performing server-side HTML sanitization. This allows an authenticated user with permission to edit dashboard component data to inject malicious HTML containing executable event handlers. When another user or a visitor accessing the dashboard via a shared link views the dashboard, these event handlers can execute, potentially leading to unintended actions.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to the execution of malicious code in the context of users viewing the affected dashboard. Since an authenticated user can inject HTML with executable event handlers, other users or visitors may unknowingly trigger these handlers, which could result in unauthorized actions, data manipulation, or exposure of sensitive information. This can compromise the integrity and security of the dashboard data and potentially the broader system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade DataEase to version 2.10.24 or later, where the issue is fixed.

Additionally, restrict dashboard component editing permissions to trusted authenticated users only to reduce the risk of malicious HTML injection.

Useful 0 Not Useful 0