DataEase vulnerabilities

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

DataEase versions 2.10.14 and below did not properly filter when establishing JDBC connections to Oracle, creating a risk of JNDI injection. This is fixed in version 2.10.15.

In DataEase versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://, but omission of protection for the dns:// protocol results in an SSRF vulnerability. The issue is fixed in version 2.10.15.

In DataEase versions up to 2.10.12, the H2 data source implementation (H2.java) does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon Redshift driver and leverages socketFactory and socketFactoryArg parameters to invoke org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext with an attacker-controlled remote XML resource, resulting in remote code execution. The issue is fixed in version 2.10.13.

In DataEase versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct malicious JDBC connection strings that exploit JNDI injection and trigger RMI deserialization, enabling remote command execution by editing the data source and providing a crafted JDBC string referencing a remote configuration file. The issue is patched in version 2.10.13.

In DataEase versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). In higher versions of Java, ldap deserialization (autoDeserialize) is disabled by default, preventing remote code execution, but SSRF remains exploitable. The issue is fixed in version 2.10.13.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field.

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.

In DataEase prior to 2.10.26, an authenticated user with folder creation permission can store HTML-bearing names. When another user opens the Move to dialog and types in its search box, attacker-controlled JavaScript executes in the victim's session (XSS).

A flaw was found in DataEase up to version 3.0.0 in the Utils.buildCalcField function of the file io/dataease/engine/utils/Utils.java. Manipulation of the calculated field argument causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A directory traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a crafted request to the StaticResourceController.java component.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another. The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE_SEPARATOR is '\', while the server only filters the '/' character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.

A vulnerability in DataEase before version 2.10.23 allows remote code execution by uploading a crafted payload.zip via the Excel upload API /datasource/upload. The attacker creates an H2 datasource using the zip: protocol and executes an SQL query that triggers precompiled Java aliases in test.mv.db, leading to arbitrary code execution.

A vulnerability in DataEase before version 2.10.23 allows arbitrary SQL read queries on connected datasources. The SQL preview function does not enforce table access restrictions.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.

In DataEase prior to version 2.10.23, SQL-type datasets store attacker-controlled SQL variable default values such as ${var}, and SqlparserUtils.handleVariableDefaultValue() inserts them using String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset.

In DataEase prior to version 2.10.23, a vulnerability was found in the bulk delete API endpoint where path traversal sequences like ../ are not sanitized. Attackers can delete arbitrary server directories through the export task cleanup mechanism.

In DataEase prior to version 2.10.23, a vulnerability was found due to insufficient path validation in template saving endpoints. An attacker can use attacker-controlled static resource names and Base64 content to perform path traversal and arbitrary file writes on the server.

In DataEase prior to version 2.10.23, a SQL injection vulnerability was found in the datasource connection status check function. An attacker can exploit the schema parameter in the SQL query, leading to unauthorized data access.

In DataEase prior to version 2.10.23, a SQL injection vulnerability was found. Dashboard SQL variables like ${deptId} are processed by SqlparserUtils.transFilter(), which returns raw user input for operators other than 'in' and 'between', and then spliced into the dashboard SQL without proper sanitization. This allows authenticated users with dashboard access to inject malicious SQL into integrated datasources.

In DataEase prior to version 2.10.24, a vulnerability exists due to a hardcoded default share link signature key. An attacker who knows this key (link-pwd-fit2cloud) can forge JWT tokens and access backend resources as the share creator, even after the original share has been revoked.

In DataEase prior to version 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard.

In DataEase before version 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources.

In DataEase prior to version 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution.

In DataEase prior to version 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container.

In DataEase prior to version 2.10.24, a vulnerability allows bypassing H2 database JDBC URL validation using special Unicode characters with different case-conversion behavior. Attackers can smuggle dangerous parameters like init in malicious JDBC strings, leading to arbitrary code execution.

In DataEase before version 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation, allowing any authenticated user to execute arbitrary SQL statements on the built-in engine database and read sensitive core data.

In DataEase before version 2.10.24, an authenticated user can download, delete, retry, or generate download links for export tasks belonging to other users by manipulating the task ID parameter. Additionally, the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files.

In DataEase prior to version 2.10.24, the share mode chart data interface fails to validate whether tableId and field IDs in the request belong to the shared resource. An attacker with a valid share link token can replace dataset identifiers and retrieve unauthorized data via the POST /de2api/chartData/getData endpoint.

In DataEase before version 2.10.24, the /de2api/share/proxyInfo share interface generates and returns the X-DE-LINK-TOKEN before validating the share password or ticket. This allows unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials.

DataEase versions 2.10.13 and earlier are vulnerable to SQL injection in the /de2api/datasetData/tableField interface. An attacker can craft a malicious tableName parameter to execute arbitrary SQL commands.

In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist; if the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks, allowing an attacker to access "upload/1.js" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript.

DataEase versions through 2.10.13 contain a JDBC driver bypass vulnerability in the H2 database connection handler. The getJdbc function in H2.java checks if jdbcUrl starts with jdbc:h2 but returns a separate jdbc field as the actual connection URL. An attacker can provide a jdbcUrl starting with jdbc:h2 while supplying a different jdbc field with an arbitrary JDBC driver and connection string, allowing an authenticated attacker to trigger arbitrary JDBC connections with malicious drivers, potentially leading to remote code execution. Fixed in version 2.10.14.

In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows an attacker to inject a malicious JDBC string into the HOSTNAME field to bypass previously patched vulnerabilities CVE-2025-57773 and CVE-2025-58045. The vulnerability is fixed in version 2.10.14. No known workarounds exist.

DataEase is a data visualization analysis tool that prior to version 1.18.9 had a SQL injection vulnerability allowing bypass of blacklists. The vulnerability has been fixed in version 1.18.9.

DataEase is a data visualization analysis tool that, in affected versions, has a missing authorization check. This allows unauthorized users to manipulate dashboards created by the administrator.

DataEase, a data visualization analysis tool, has a privilege bypass vulnerability that allows ordinary users to access the user database. Exposed information includes md5 hashes of passwords, usernames, email addresses, and phone numbers.

DataEase is a data visualization analysis tool that in affected versions allows unauthorized users to delete an application. This vulnerability has been fixed in version 1.18.8.