DataEase up to 1.18.10 File ImageIO.read unrestricted upload

Summaryinfo

A vulnerability, which was classified as problematic, has been found in DataEase up to 1.18.10. This affects the function ImageIO.read of the component File Handler. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2023-40183. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in DataEase up to 1.18.10 and classified as problematic. This issue affects the function ImageIO.read of the component File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality. The summary by CVE is:

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.

The weakness was presented 09/21/2023 as GHSA-w2r4-2r4w-fjxv. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-40183 since 08/09/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 1.18.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 826513053146721a2b3e09a9c9d3ea41f8f10569 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• DataEase

Version

• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4
• 1.18.5
• 1.18.6
• 1.18.7
• 1.18.8
• 1.18.9
• 1.18.10

License

• open-source

Website

• Product: https://github.com/dataease/dataease/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion