Executive brief
DataEase, an open-source data visualization and analysis tool, contains a critical vulnerability in its Enterprise edition's authentication mechanism. An attacker can bypass security controls by forging identity tokens, allowing them to impersonate any user, including administrators. Once authenticated, the attacker can exploit further weaknesses to execute arbitrary commands on the server, potentially leading to a full system takeover, data theft, or service disruption.
Technical details
A vulnerability in DataEase Enterprise edition (prior to 2.10.23) exists because TokenFilter#doFilter() and TokenUtils.validate() only perform presence and length checks on the X-DE-TOKEN header. The system uses JWT.decode() to extract user identity (uid/oid) without verifying the cryptographic signature when LicenseUtil.licenseValid() is true. An attacker can forge a JWT to gain authenticated access. By combining this with a secondary vulnerability in the Redshift JDBC driver handling—specifically the lack of sanitization for 'loggerFile' and 'loggerLevel' parameters—an attacker can perform arbitrary file writes. In environments with default scheduled tasks (e.g., /etc/periodic/15min), this leads to unauthorized Remote Code Execution (RCE).
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-28: patched: Fixed in version 2.10.23
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date