CVE-2024-55890 PoC — D-Tale allows Remote Code Execution through the Custom Filter Input

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55890.yaml

Associated Vulnerability

Title:D-Tale allows Remote Code Execution through the Custom Filter Input (CVE-2024-55890)
Description:D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Description

D-Tale prior to version 3.16.1 contains a remote code execution caused by the `update-settings` endpoint allowing updates to `enable_custom_filters`, letting attackers run malicious code on the server, exploit requires hosting D-Tale publicly.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →