DataEase CVE-2025-62421

Exploitation requires reaching the DataEase StaticResourceApi 'upload/{fileId}' route and supplying a URL path whose extension (e.g. '.js' or similar) is in the TokenFilter/WhitelistUtils allowlist, which causes the permission/authentication check to be skipped - this is the authentication-bypass precondition and needs no valid credentials. The attacker must be able to upload an HTML file carrying JavaScript via this route. The principal LIMITING factor is that, as stored XSS, a separate victim must subsequently access the uploaded malicious file URL for the script to execute in their browser; impact is confined to the browser/session context (no server confidentiality, integrity, or availability impact per VC:N/VI:N/VA:N). Affected deployments are DataEase versions through 2.10.13; there are no known workarounds, so only the 2.10.14 upgrade remediates it.

Signals converge on a genuine-but-moderate priority rather than an urgent one. The GitHub-assigned CVSS 4.0 vector scores 5.5 (Medium) with AV:N/AC:L/PR:N (network, low complexity, no authentication - consistent with the described authentication bypass), but critically VC:N/VI:N/VA:N with only SC:L/SI:L, meaning no impact to the DataEase server itself and only limited confidentiality/integrity impact to subsequent systems (the victim's browser session), which is the correct modeling for stored XSS. EPSS is low at 0.27% (18th percentile), indicating low modeled probability of widespread exploitation. The CVE is NOT on CISA KEV, so exploitation status is 'no public exploit identified at time of analysis' - however, note a conflicting signal: the CVSS 4.0 vector carries E:P (Exploit maturity = Proof-of-Concept), which suggests proof-of-concept material may exist even though no exploit/POC link is present in the provided references. No SSVC decision data was supplied. Net: this is a real, patch-worthy flaw (unauthenticated stored XSS via allowlist bypass) but not a drop-everything emergency - the capped browser-side impact, low EPSS, and absence of KEV all argue against widespread automated exploitation, while the unauthenticated upload primitive and possible PoC argue for prompt patching, especially on internet-exposed instances.

An unauthenticated attacker crafts a request to the StaticResourceApi 'upload/{fileId}' route (e.g. 'upload/1.js'), where the trailing .js extension causes TokenFilter's WhitelistUtils#match to treat the path as a safe static resource and skip permission checks, letting the attacker upload an HTML file containing malicious JavaScript. When a DataEase user (such as an administrator) later accesses that stored file URL, the script executes in their authenticated browser context, enabling session-context actions or data theft. The CVSS vector's E:P flag indicates proof-of-concept-level exploit material may exist, though no public POC link is included in the provided references.