Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-52295
CVE-2024-52295:
Java vulnerability analysis and mitigation
Overview
DataEase, an open source data visualization analysis tool, was found to contain a critical vulnerability (CVE-2024-52295) that allows attackers to forge JWT tokens and take over services. The vulnerability was discovered in versions prior to 2.10.2, where the JWT secret was hardcoded in the code along with hardcoded UID and OID values. The issue was disclosed on November 13, 2024, and has been fixed in version 2.10.2 (GitHub Advisory).
Technical details
The vulnerability stems from the hardcoded JWT secret (83d923c9f1d8fcaa46cae0ed2aaa81b5) in the SubstituleLoginServer class, along with hardcoded user ID (UID=1) and organization ID (OID=1) values. This implementation allows attackers to generate valid JWT tokens by using the known secret to sign tokens with arbitrary expiration times. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (NVD).
Impact
The vulnerability enables attackers to bypass authentication and gain unauthorized access to the system with administrative privileges. Using forged JWT tokens, attackers can access sensitive information and take control of the service. A proof of concept demonstrated the ability to access database configurations on the official demo website using forged tokens (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in DataEase version 2.10.2. Users running affected versions (2.10.1 and earlier) are strongly recommended to upgrade to version 2.10.2 to address this security issue (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management