Arbitrary File Reading Vulnerability in DataEase

CVE-2024-31441

Summary

DataEase, an open-source data visualization analysis tool, is susceptible to a vulnerability that allows for arbitrary file reading due to inadequate restrictions on connection parameters for the ClickHouse data source. Malicious actors can exploit this flaw by injecting specific harmful parameters into the connection, potentially leading to unauthorized access to sensitive files on the server. The vulnerability has been addressed in version 1.18.19, making it crucial for users to update their installations to mitigate any risks associated with this issue. More details can be found in the security advisory at the official GitHub repository.

References