DataEase pre-v2.10.26 Share Module Access Control Flaws

DataEase Share Link Module Access Control Vulnerability Summary Vulnerability Overview Title: Access Control Vulnerability in the DataEase Share Link Module Severity: High CVE ID: None (No known CVE) Affected Package: (Maven) Affected Versions: < v2.10.26 Fixed Version: v2.10.26 Key Issues (4 Issues) Issue A: Share ticket not bound to / validated against the target share UUID Related Endpoint: Issue: The ticket validation logic only looks up records based on the ticket string and does not verify whether the share UUID associated with the ticket matches the share UUID being accessed in the request. POC: A valid ticket originally issued for Share A can be submitted to Share B; if the password validation for Share B succeeds, will still return a valid . Potential Impact: - Tickets can be reused across different shares - Tickets belonging to Share A can be abused to access Share B - If a ticket is leaked (via URL, email, logs, or browser history), the attack surface expands to other published shares Issue B: /share/validate issues a LinkToken without a ticket after successful password validation Affected Endpoint: Issue: After successfully validating the share UUID and password, this endpoint directly generates and returns a LinkToken, without requiring or validating a ticket. Actual Verification: Even if the target share has , a valid can be returned using only the correct share UUID and password (without a ticket). Potential Impact: - The “mandatory ticket” share policy can be bypassed - Obtaining the share UUID and password is sufficient to acquire a LinkToken, without a ticket - Inconsistent with the “password + ticket + expiration time” triple validation in Issue C: Ticket creation/deletion endpoints lack share ownership validation Affected Endpoints: - - Issue: and primarily look up/update/delete records based on the ticket string, without explicitly verifying that the current user is the creator or administrator of the associated share. POC: An authenticated user can modify the bound share UUID, configuration parameters, and expiration time of another user's share ticket, or permanently delete it. Potential Impact: - Third-party share tickets may be deleted, causing interruption in accessing public shares (service unavailability) - Tickets can be reconfigured and bound to unrelated shares - Can be combined with the cross-share ticket reuse vulnerability in Issue A, expanding the risk Issue D: queryRelationByUserId allows enumerating other users' share mappings Affected Endpoint: Issue: The endpoint directly queries share relationships using the path parameter, without restricting it to one's own ID and lacking administrator privilege protection. Actual Verification: An authenticated user can query other users' share mappings, obtaining the correspondence between resources and share UUIDs. Potential Impact: - Leaks share identifiers created by other platform users - Provides attackers with auxiliary information for share link enumeration and access control testing - Combining this with ticket validation vulnerabilities reduces the difficulty of locating target shares Overall Impact All four issues require a valid, authenticated user session to exploit; unauthenticated attack vectors have not yet been confirmed. If confirmed as security vulnerabilities, successful exploitation could lead to: - Cross-share reuse of access tickets - Bypassing mandatory ticket share policies - Unauthorized modification/deletion of other users' share tickets - Enumeration of share resources owned by other users Resolution Patch: This vulnerability has been fixed in v2.10.26. Temporary Mitigation (Workaround): It is recommended to upgrade the version to v2.10.26. References Issue Reporting: Submit an Issue at Email Contact:

Goal Reached Thanks to every supporter — we hit 100%!

DataEase pre-v2.10.26 Share Module Access Control Flaws

More from this source