CVE-2024-55890 Scanner

D-Tale is an interactive data visualization tool used by data scientists and analysts for managing and exploring large datasets. It offers a dynamic interface for manipulating data frames, enabling users to gain insights through interactive plots and charts. This tool integrates seamlessly with Pandas, providing a comprehensive environment for data analysis and visualization. It is commonly employed in environments requiring real-time data interaction and visualization. D-Tale is hosted on web servers, sometimes publicly, allowing users remote interaction capabilities. Its extensive use in the data science community makes security a paramount concern.

Remote Code Execution (RCE) is a critical vulnerability that allows attackers to execute arbitrary code on the target server. This vulnerability typically arises when user input is not properly sanitized, enabling malicious commands to be injected and run on the server. In the case of D-Tale versions <= 3.16.0, this vulnerability is present due to improper handling of the `update-settings` endpoint. The vulnerability is exacerbated when D-Tale is publicly accessible, increasing the risk of unauthorized access. Successful exploitation can lead to complete system compromise, with attackers gaining unauthorized administrative control. It is imperative that measures are taken to mitigate this vulnerability to prevent exploitation.

In D-Tale versions <= 3.16.0, the `update-settings` endpoint includes a parameter `enable_custom_filters` that can be exploited. When improperly secured, attackers can manipulate this parameter to enable the execution of arbitrary Python code. The exploitation process involves sending specially crafted HTTP requests that inject and execute malicious commands. Using the Pandas `query` functionality, an attacker can execute system commands via Python's built-in functions. The attack can be initiated from a distance, making it particularly dangerous in publicly hosted environments. This endpoint was patched in version 3.16.1, which blocks the vulnerable parameter updates, preventing exploitation.

When exploited, this RCE vulnerability can lead to severe repercussions, such as unauthorized data access and system manipulation. Attackers could deploy additional malware, compromise sensitive information, or use the server as a staging ground for further attacks. The complete system compromise can disrupt the operations of businesses relying on D-Tale for critical data processing tasks. Additionally, backend systems could be used to distribute ransomware, further amplifying the damage. Consequently, any organization using versions prior to 3.16.1 is at significant risk until the issue is resolved by upgrading.

REFERENCES

• https://github.com/man-group/dtale/security/advisories/GHSA-qx2x-gvj9-gxw2
• https://nvd.nist.gov/vuln/detail/CVE-2024-55890