CVE-2024-3408 in the critical feed json
Authentication Bypass and RCE in man-group/dtale
published 2024-06-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-v9q6-fm48-rx74 , PYSEC-2024-117 , EUVD-2024-0050
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 78.0%
- EPSS 78.0% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.
Patch / fix
Timeline
- Published
- First public exploit (Metasploit exploit/linux/http/dtale_rce_cve_2025_0655)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
77.97% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/dtale_rce_cve_2025_0655 D-Tale RCE metasploit exploit, excellent rank, 2025-02-05
- Nuclei template D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution nuclei detection template
- huntr.com https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | dtale | <=3.10.0 all versions |
no fix listed |
Affected products
- man-group man-group/dtale
- man-group dtale
Classification
References
-
github.com
/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13
web, patch
-
huntr.com
/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91
web, exploit, third-party-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2024-3408
advisory
-
github.com
/man-group/dtale
package
-
github.com
/pypa/advisory-database/tree/main/vulns/dtale/PYSEC-2024-117.yaml
web
-
github.com
/advisories/GHSA-v9q6-fm48-rx74
advisory
Sources
- CVE List CVE-2024-3408
- GitHub Advisory GHSA-v9q6-fm48-rx74
- NVD CVE-2024-3408
- OSV PYSEC-2024-117
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.