PT-2024-2073 · Dataease · Dataease

Liangyueliangyue · Published 2024-02-01 · Updated 2025-01-08 · CVE-2024-23328

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Dataease versions prior to 1.18.15 Dataease versions prior to 2.3.0

Description A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. The blacklist of mysql jdbc attacks can be bypassed, allowing attackers to further exploit it for deserialized execution or reading arbitrary files.

Recommendations For versions prior to 1.18.15, update to version 1.18.15 or later to resolve the issue. For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Mysql.java file in the core/core-backend/src/main/java/io/dataease/datasource/type directory until a patch is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-01967

CVE-2024-23328

GHSA-8X8Q-P622-JF25

Affected Products

Dataease

References · 8

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23328.json · Exploit
• https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a · Patch
• https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a · Patch
• https://osv.dev/vulnerability/CVE-2024-23328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23328 · Security Note
• https://bdu.fstec.ru/vul/2024-01967 · Security Note
• https://twitter.com/CVEnew/status/1753083930906173943 · Twitter Post