CVE-2026-33083: DataEase SQL Injection Vulnerability

CVE-2026-33083 Overview

DataEase is an open-source data visualization and analytics platform. A SQL injection vulnerability has been identified in versions 2.10.20 and below, affecting the orderDirection parameter used in dataset-related endpoints. The vulnerable endpoints include /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLObj class directly assigns the raw user-supplied orderDirection value into the SQL query without any validation or whitelist enforcement, and the value is rendered into the ORDER BY clause via StringTemplate before being executed against the database.

Critical Impact

An authenticated attacker can inject arbitrary SQL commands through the sorting direction field, enabling time-based blind data extraction and denial of service against the underlying database.

Affected Products

• DataEase versions 2.10.20 and below
• DataEase dataset-related API endpoints (/de2api/datasetData/enumValueDs)
• DataEase export functionality (/de2api/datasetTree/exportDataset)

Discovery Timeline

• 2026-04-16 - CVE-2026-33083 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-33083

Vulnerability Analysis

This SQL injection vulnerability stems from insufficient input validation in the DataEase platform's dataset API endpoints. The orderDirection parameter, typically expected to contain standard SQL sorting directives like ASC or DESC, is processed without proper sanitization or whitelist validation.

The vulnerable code path allows attackers to break out of the intended ORDER BY clause context and inject arbitrary SQL statements. Since the platform uses StringTemplate for SQL query construction, the raw user input is directly concatenated into the final query string before database execution. This creates a classic second-order SQL injection scenario where authenticated users can manipulate query logic.

The exploitation requires valid authentication credentials, but once authenticated, an attacker can leverage time-based blind injection techniques to extract sensitive data from the database or cause denial of service through resource-intensive queries.

Root Cause

The root cause lies in the Order2SQLObj class, which fails to implement proper input validation for the orderDirection parameter. Instead of enforcing a strict whitelist of allowed values (such as ASC and DESC), the class directly incorporates user-supplied input into the SQL query construction process. The StringTemplate rendering mechanism then embeds this unsanitized value into the ORDER BY clause, creating an injection point that bypasses any existing security controls.

Attack Vector

The attack is network-based and requires low-privilege authentication. An authenticated attacker sends a crafted HTTP request to the vulnerable dataset endpoints with a malicious orderDirection parameter value. Instead of providing a legitimate sorting direction, the attacker injects SQL syntax that escapes the ORDER BY context and executes additional commands. Time-based blind techniques allow data extraction even without direct query output visibility. The network attack vector combined with low complexity makes this vulnerability accessible to authenticated adversaries with basic SQL injection knowledge.

Detection Methods for CVE-2026-33083

Indicators of Compromise

• Unusual SQL error messages in DataEase application logs referencing ORDER BY clause syntax errors
• HTTP requests to /de2api/datasetData/enumValueDs or /de2api/datasetTree/exportDataset containing SQL keywords like SLEEP, WAITFOR, BENCHMARK, or UNION in the orderDirection parameter
• Abnormal response time patterns suggesting time-based SQL injection exploitation
• Database audit logs showing unexpected query patterns or unauthorized data access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection payloads in API request parameters, particularly focusing on the orderDirection field
• Configure database query logging to capture and alert on anomalous ORDER BY clause patterns
• Deploy application-layer intrusion detection to monitor for time-based blind SQL injection signatures
• Enable authentication logging to correlate suspicious database activity with specific user sessions

Monitoring Recommendations

• Monitor DataEase API endpoint response times for statistical anomalies that may indicate time-based injection attempts
• Set up alerts for failed SQL query executions that reference syntax errors in sorting clauses
• Track and baseline normal orderDirection parameter values to identify deviations from expected ASC/DESC patterns
• Review authentication logs for accounts exhibiting suspicious API access patterns to dataset endpoints

How to Mitigate CVE-2026-33083

Immediate Actions Required

• Upgrade DataEase to version 2.10.21 or later immediately to remediate the vulnerability
• Review database access logs for evidence of exploitation prior to patching
• Implement WAF rules to block requests containing SQL injection patterns in the orderDirection parameter as a temporary measure
• Audit user accounts with access to dataset endpoints for any signs of compromise

Patch Information

The DataEase development team has addressed this vulnerability in version 2.10.21. The fix implements proper validation and whitelist enforcement for the orderDirection parameter. Organizations should update their DataEase installations by downloading the patched version from the GitHub Release v2.10.21. For complete technical details about this vulnerability and the remediation approach, refer to the GitHub Security Advisory GHSA-f443-95cf-m837.

Workarounds

• If immediate patching is not possible, restrict network access to DataEase API endpoints using firewall rules to limit exposure to trusted networks only
• Implement strict input validation at the reverse proxy or load balancer level to reject requests with non-standard orderDirection values
• Temporarily disable or restrict access to the vulnerable endpoints (/de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset) if dataset functionality is not critical
• Enforce principle of least privilege for DataEase user accounts to minimize potential impact of exploitation

# Example WAF rule to block SQL injection in orderDirection parameter
# ModSecurity rule example
SecRule ARGS:orderDirection "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in orderDirection parameter',\
    log,\
    auditlog"