Executive brief
DataEase is a data visualization and analytics platform. A directory traversal vulnerability in the static file serving component allows remote attackers to read sensitive server configuration files by crafting malicious file paths, particularly in Windows deployments. This could expose database credentials, API keys, and other secrets stored in configuration files.
Technical details
A directory traversal vulnerability exists in StaticResourceController.java that inadequately validates file path inputs. The vulnerability stems from incomplete path normalization: while the code blocks "../" sequences on Linux systems, it fails to block "..\" (backslash) directory traversal on Windows environments. An unauthenticated remote attacker can craft requests containing backslash-based path traversal sequences to escape the intended static resource directory and access arbitrary files on the server, including application configuration files containing sensitive data. The vulnerability affects DataEase versions up to 1.18.9; patching is available in version 1.18.10 and later.
Affected products
- DataEase DataEase before 1.18.10
Timeline
- 2023-08-09: disclosed
- 2023: patched: Fixed in version 1.18.10