PyPIdtaleGHSA-v9q6-fm48-rx74PYSEC-2024-117
No fixed version published. Check the advisory or remove the package.
Affected versions, by release line
| If you run | Upgrade to |
|---|---|
| All versions | No fix published |
| 3.10.0 and earlier | No fix published |
CVE-2024-3408 Public exploit Critical · 9.8 EPSS 78.0%
Authentication Bypass and RCE in man-group/dtale
man-group · man-group/dtale
Summary
The man-group/dtale product (version 3.10.0) contains an authentication bypass and remote code execution flaw in its Flask configuration and custom filter handling, stemming from a hardcoded SECRET_KEY and insufficient input validation. An attacker with network access and no privileges or user interaction can forge a session cookie when authentication is enabled, and can execute arbitrary code on the server via the /update-settings endpoint even when enable_custom_filters is turned off.
Official description · CVE.org
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
71.8 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 22 months after disclosure. Public exploit code (Metasploit) appeared 8 months after disclosure.
- Disclosedday 0
- Public exploit codeMetasploit+8 mo
- First seen exploitedVulnCheck KEV evidence+22 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV1 package in 1 ecosystem. Main package: dtale.