Authentication Bypass Risk in DataEase Data Visualization Tool

CVE-2024-56511

What is CVE-2024-56511?

DataEase, an open-source data visualization analysis tool, contains an authentication flaw that allows attackers to bypass security mechanisms and gain unauthorized access. The issue resides within the ‘io.dataease.auth.filter.TokenFilter’ class, where the ability to determine if a URL request requires authentication can be circumvented. Specifically, due to insufficient filtering of URL patterns when users set the 'server.servlet.context-path', malicious actors can exploit this weakness using tailored request URIs. This vulnerability was addressed in version 2.10.4, underscoring the importance of updating to secure systems against potential threats.

References