Man-Group Dtale Version 3.10.0 Vulnerable to Authentication Bypass and Remote Code Execution

CVE-2024-3408

Summary

D-Tale version 3.10.0 exhibits vulnerability due to inadequate input validation leading to an authentication bypass and remote code execution (RCE). A hardcoded 'SECRET_KEY' within the Flask configuration allows adversaries to create forged session cookies when authentication is present. Furthermore, the application does not properly restrict custom filter queries, granting malicious users the ability to perform arbitrary code execution on the server. This occurs even with the 'enable_custom_filters' option disabled, allowing attacks to exploit the '/update-settings' endpoint without sufficient safeguards.

References