Vulnerability · Published Sep 21, 2023 · Assigned by GitHub_M

CVE-2023-40183DataEase has a vulnerability to obtain user cookies

High 7.5

In plain English

A high-severity unrestricted file upload in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 43.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 1.18.11

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-w2r4-2r4w-fjxv x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/826513053146721a2b3e09a9c9d3ea41f8f10569 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v1.18.11 x_refsource_MISC