CVE-2024-23328: Dataease RCE Vulnerability via Deserialization

CVE-2024-23328 Overview

CVE-2024-23328 is an insecure deserialization vulnerability in DataEase, an open source data visualization analysis tool. The vulnerability exists in the DataEase MySQL datasource component, where attackers can bypass the blacklist protection for MySQL JDBC attacks to execute arbitrary code or read arbitrary files from vulnerable systems.

Critical Impact

This vulnerability allows unauthenticated remote attackers to bypass security controls and achieve arbitrary code execution or sensitive file disclosure on systems running vulnerable versions of DataEase.

Affected Products

• DataEase versions prior to 1.18.15
• DataEase versions prior to 2.3.0

Discovery Timeline

• 2024-02-29 - CVE-2024-23328 published to NVD
• 2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-23328

Vulnerability Analysis

The vulnerability resides in the MySQL datasource configuration handling within DataEase. Specifically, the vulnerable code is located at core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. The application implements a blacklist approach to prevent malicious MySQL JDBC connection string parameters that could trigger deserialization attacks. However, this blacklist can be bypassed by attackers using URL encoding or other evasion techniques.

When a user configures a MySQL datasource connection, the application fails to properly decode and validate the connection parameters before checking against the blacklist. This allows attackers to craft malicious JDBC connection strings that evade detection while still triggering unsafe deserialization behavior when the connection is established.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The application's blacklist-based security approach for MySQL JDBC parameters is insufficient because:

1. The blacklist validation does not properly handle URL-encoded input
2. Attackers can bypass the blacklist by encoding malicious parameters
3. The MySQL JDBC driver supports features that can trigger deserialization of attacker-controlled data

The security patch addresses this by implementing proper URL decoding before validation, as shown in the commit changes that add URLDecoder imports to properly normalize input before blacklist checking.

Attack Vector

The attack is network-based and can be executed by an unauthenticated remote attacker. The exploitation flow involves:

1. An attacker accesses the DataEase datasource configuration interface
2. The attacker crafts a malicious MySQL JDBC connection string with URL-encoded parameters designed to bypass the blacklist
3. When the datasource connection is tested or established, the malicious parameters trigger deserialization
4. The attacker achieves arbitrary code execution or arbitrary file read depending on the payload used

// Security patch excerpt from Mysql.java
// Source: https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a

import org.apache.commons.lang3.StringUtils;
import org.springframework.stereotype.Component;

+import java.net.URLDecoder;
import java.util.Arrays;
import java.util.List;

The patch introduces URLDecoder to properly decode connection parameters before validation, preventing encoded bypass attempts.

Detection Methods for CVE-2024-23328

Indicators of Compromise

• Unusual MySQL datasource configurations containing encoded or obfuscated connection parameters
• Unexpected outbound connections from the DataEase application server to external hosts
• Evidence of file access outside normal application directories
• Java deserialization-related error messages or stack traces in application logs
• Suspicious process spawning from the DataEase Java process

Detection Strategies

• Monitor DataEase application logs for unusual datasource configuration attempts, particularly those containing URL-encoded special characters
• Implement network monitoring for JDBC connections to unexpected destinations or ports
• Deploy endpoint detection rules to identify deserialization attack patterns in Java applications
• Review audit logs for datasource creation or modification events from unauthorized users

Monitoring Recommendations

• Enable verbose logging for the DataEase datasource module to capture connection string parameters
• Implement alerting on failed datasource connection attempts that may indicate reconnaissance activity
• Monitor for file system access patterns indicative of arbitrary file read exploitation
• Track process execution trees to identify code execution following datasource operations

How to Mitigate CVE-2024-23328

Immediate Actions Required

• Upgrade DataEase to version 1.18.15 or later for the 1.x branch
• Upgrade DataEase to version 2.3.0 or later for the 2.x branch
• Review existing datasource configurations for suspicious or unauthorized entries
• Restrict network access to the DataEase administration interface to trusted networks only

Patch Information

DataEase has released security patches addressing this vulnerability. The fixes are available in versions 1.18.15 and 2.3.0. The patches implement proper URL decoding of MySQL JDBC connection parameters before blacklist validation, preventing encoded bypass techniques.

Relevant commits:

• GitHub Commit 4128adf5 - Fix for core-backend module
• GitHub Commit bb540e6d - Fix for backend module

For complete details, see the GitHub Security Advisory GHSA-8x8q-p622-jf25.

Workarounds

• Implement network segmentation to restrict access to the DataEase datasource configuration interface
• Deploy a web application firewall (WAF) to filter malicious JDBC connection parameters
• Disable or restrict datasource creation capabilities to only trusted administrators
• Monitor and audit all datasource configuration changes until patching is complete

# Example: Restrict network access to DataEase admin interface using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP