man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91 | Exploit Third Party Advisory |
| https://github.com/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13 |
Configurations
History
03 Nov 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE |
15 Oct 2024, 20:14
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 CWE-798 |
|
| First Time |
Man
Man d-tale |
|
| References | () https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:man:d-tale:3.10.0:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
06 Jun 2024, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:16
Updated : 2024-11-03 17:15
NVD link : CVE-2024-3408
Mitre link : CVE-2024-3408
JSON object : View
Products Affected
man
- d-tale
CWE
CWE-798
Use of Hard-coded Credentials