CVE-2024-56511

DataEase versions prior to 2.10.4 contain an authentication bypass (CWE-289) in the io.dataease.auth.filter.TokenFilter class, which uses request.getRequestURI and the WhitelistUtils.match method to decide whether an incoming request may skip authentication. The match routine only filters semicolons and does not fully normalize the URI, so a request that puts a whitelisted prefix followed by path-traversal segments before the configured context path (e.g. /geo/../<context-path>/) still matches the no-auth whitelist and reaches protected interfaces unauthenticated; the flaw is described for deployments where a custom server.servlet.context-path is configured. A remote, unprivileged attacker needs no user interaction and gains unauthorized access to otherwise protected DataEase functionality, with high impact on confidentiality, integrity and availability reflected in the critical CVSS 4.0 score of 9.3. Anyone running DataEase below 2.10.4 is affected, especially instances that set server.servlet.context-path at deployment time. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public advisory/PoC exists and EPSS assigns a 44.5% probability of exploitation within 30 days (99th percentile), so scanning and opportunistic exploitation are likely.

What to do: Upgrade to DataEase v2.10.4 or later, which fixes the bypass. As interim mitigation, restrict network access to the instance (firewall/VPN) and, where a reverse proxy fronts DataEase, block request URIs containing path-traversal sequences with whitelisted prefixes (e.g. /geo/../) to the application; also check whether server.servlet.context-path is configured, since deployments with a custom context path are the ones described as bypassable.