Description
DataEase是一个开源数据可视化和分析工具,在版本2.5.0之前存在数据库配置信息暴露漏洞。通过浏览器访问/de2api/engine/getEngine;.js路径可以获取平台的数据库配置。
DataEase /de2api/engine/getEngine;.js 信息泄露漏洞（CVE-2024-30269）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5
https://nvd.nist.gov/vuln/detail/CVE-2024-30269
https://cn-sec.com/archives/3246474.html
https://stack.chaitin.com/vuldb/detail/e5450786-ec74-47cd-b4f5-fb598c6be092
https://avd.aliyun.com/detail?id=AVD-2024-30269
https://pentest-tools.com/vulnerabilities-exploits/dataease-241-sensitive-information-exposure_23143