DataEase SQL Injection Vulnerability in Dataset Data Interface

A SQL injection vulnerability has been identified in DataEase versions 2.10.13 and earlier. The issue arises in the '/de2api/datasetData/tableField' interface, where an attacker can manipulate the 'tableName' parameter to execute arbitrary SQL commands. This vulnerability has been patched in version 2.10.14.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can execute arbitrary SQL commands, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, create an Elastic Search server and insert some data. Then, import the corresponding Elastic Search data source and dataset into DataEase. After that, access the '/de2api/datasetData/tableField' interface and provide a crafted 'tableName' parameter that includes malicious SQL payloads. The server will execute the injected SQL commands, demonstrating the SQL injection vulnerability.

Remediation

Users are advised to upgrade to DataEase version 2.10.14, where this vulnerability has been fixed.