Hardcoded Key Bypass in DataEase

Executive Summary

This vulnerability affects DataEase, an open source data visualization and analysis tool, specifically versions prior to 2.10.24. The ShareSecretManage component uses a hardcoded default share link signature key. An attacker who obtains a passwordless share for a resource and user can exploit this known key (link-pwd-fit2cloud) to forge linkToken JWTs. This allows the attacker to bypass TokenFilter verification and access backend resources as if they were the share creator, even if the original share has been revoked.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to gain unauthorized access to backend resources by forging authentication tokens. This means sensitive data or functionalities could be accessed or manipulated by unauthorized users, potentially leading to data breaches, loss of data integrity, or unauthorized actions within the system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in DataEase version 2.10.24. Immediate mitigation involves upgrading ShareSecretManage to version 2.10.24 or later to eliminate the use of the hardcoded default share link signature key.

Until the upgrade is applied, avoid using passwordless shares and revoke any existing shares that might be vulnerable to token forgery.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to forge JWT tokens and gain unauthorized access to sensitive backend resources, potentially leading to unauthorized data exposure or exfiltration.

Such unauthorized access and potential data breaches can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Because attackers can impersonate share creators and access protected endpoints without authentication, organizations using affected versions prior to 2.10.24 may face increased risk of non-compliance due to inadequate access controls and potential data leakage.

Applying the patch in version 2.10.24 is critical to restore secure access controls and help maintain compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of a hardcoded JWT signing secret key (link-pwd-fit2cloud) in DataEase versions prior to 2.10.24, which allows attackers to forge tokens and access backend resources without authentication.

To detect exploitation attempts or presence of this vulnerability on your system or network, you can monitor for JWT tokens signed with the known hardcoded key or look for unauthorized access to share link endpoints.

Suggested detection steps include:

• Capture and inspect JWT tokens used in requests to DataEase share link endpoints to check if they are signed with the hardcoded key 'link-pwd-fit2cloud'.
• Monitor access logs for unusual or unauthorized access patterns to dataset previews, chart data, or table structures that could indicate token forgery.
• Use network packet capture tools (e.g., tcpdump, Wireshark) to capture HTTP requests to the backend and extract JWT tokens for analysis.

Example commands:

• Use tcpdump to capture HTTP traffic on port 80 or 443 (adjust as needed): tcpdump -i any -A -s 0 'tcp port 80 or tcp port 443' | grep 'Authorization'
• Extract JWT tokens from logs or captured traffic and decode them using jwt.io or command line tools like jwt-cli to inspect the signature and payload.
• Check logs for requests containing share links or tokens and verify if the tokens can be validated using the known hardcoded key.

Ultimately, the best mitigation is to upgrade to version 2.10.24 or later, as no workarounds are recommended.

Useful 0 Not Useful 0