PT-2024-18992 · D-Tale · D-Tale

Sylwia-Budzynska · Published 2024-01-05 · Updated 2024-01-18 · CVE-2024-21642

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Tale versions prior to 3.9.0

Description D-Tale is a visualizer for Pandas data structures. Users hosting versions prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server.

Recommendations For versions prior to 3.9.0, the only workaround is to only host D-Tale to trusted users. Upgrade to version 3.9.0, where the Load From the Web input is turned off by default.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-21642

GHSA-7HFX-H3J3-RWQ4

Affected Products

D-Tale

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21642.json · Exploit
• https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4 · Vendor Advisory
• https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2 · Patch
• https://osv.dev/vulnerability/GHSA-7hfx-h3j3-rwq4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21642 · Security Note
• https://github.com/man-group/dtale · Note
• https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets · Note
• https://t.me/cvenotify/66575 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1743416162786902136 · Twitter Post
• https://twitter.com/CVEnew/status/1743383178373673216 · Twitter Post
• https://twitter.com/GHSecurityLab/status/1745534799689793915 · Twitter Post
• https://t.me/cvenotify/67914 · Telegram Post