CVE-2024-57707
Published: 07 February 2025
Summary
CVE-2024-57707 is a critical-severity Code Injection (CWE-94) vulnerability in Dataease Dataease. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of user account and password inputs to directly prevent code injection (CWE-94) in DataEase authentication components.
Mandates identification, reporting, and remediation of flaws like CVE-2024-57707 to patch the vulnerable code execution path.
Implements memory protections that mitigate arbitrary code execution resulting from successful injection attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated code injection (CWE-94) in public-facing DataEase auth component directly enables T1190 for arbitrary code execution and server takeover.
NVD Description
An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.
Deeper analysisAI
CVE-2024-57707 is a critical code injection vulnerability (CWE-94) in DataEase version 1, enabling arbitrary code execution through the user account and password components. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on 2025-02-07 and affects the application's authentication mechanisms, allowing attackers to inject and execute malicious code remotely.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access, compromising confidentiality, integrity, and availability by executing arbitrary code on the affected DataEase v1 instance, potentially leading to full server takeover.
For mitigation details, refer to the advisory at https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.md.
Details
- CWE(s)