DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
CVE-2024-56511
Verified
Description
DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.
Severity
Critical
CVSS Score
9.8
Exploit Probability
50%
Affected Product
dataease
Published Date
May 2, 2026
Template Author
chrisjr404
CVE-2024-56511.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2024-56511
CWE ID:
cwe-289
Remediation Steps
Upgrade to DataEase 2.10.4 or later, which normalizes the request path before whitelist matching.