Technical impact
DataEase, an open source data visualization and analysis platform, had a flaw in its enterprise token handling before version 2.10.23. The TokenFilter#doFilter() method passed the X‑DE‑TOKEN header to TokenUtils.validate(), which only checked for token presence and length. The subsequent call to userBOByToken(token) decoded the JWT without verifying its signature, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. Attackers could thus create tokens that impersonated any user or privilege level, enabling unauthorized command execution without proper authentication, a high‑severity remote command execution vulnerability. This issue is fixed in version 2.10.23.
Affected Systems
The vulnerability affects all installations of DataEase older than version 2.10.23. The issue was addressed in the v2.10.23 release, so any deployment using a prior release is susceptible.
Risk and Exploitability
The CVSS score of 9.5 reflects the severe impact and wide privilege escalation potential, but the EPSS score of less than 1% indicates a low probability of exploitation at present. The attack requires sending an HTTP request with a forged X‑DE‑TOKEN header, which is typically feasible for anyone who can reach the DataEase web interface. As of now, the vulnerability is not catalogued in CISA’s KEV list, suggesting that no widespread public exploitation has been documented. Nonetheless, the high reliability of the flaw and its potential for complete system takeover warrant immediate remediation.
