Man-group/dtale - Information Disclosure (CVE-2024-3408)
Description
Man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded SECRET_KEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the /update-settings endpoint, even when enable_custom_filters is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.
psychologyCrowdSec Analysis
CVE-2024-3408 is a critical vulnerability in Man-group/dtale version 3.10.0 that allows attackers to bypass authentication and achieve remote code execution due to a hardcoded SECRET_KEY and improper input validation. By forging session cookies and exploiting insufficient restrictions on custom filter queries, unauthenticated attackers can gain full control over the affected server. This flaw poses a severe risk of information disclosure, data manipulation, and system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.
CrowdSec network observations suggest that most exploitation of CVE-2024-3408 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2024-3408. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Attackers exploit D-Tale instances by forging session cookies to bypass authentication and then interact with endpoints such as /dtale/popup/upload, /dtale/upload, /dtale/update-settings/, and /dtale/test-filter/ to achieve remote code execution. These attack patterns involve sending crafted requests with a hardcoded session cookie and leveraging the vulnerable endpoints to execute arbitrary commands on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-06 |
| Rule Released | 2026-03-30 |
| CrowdSec First Seen | 2026-04-01 |
Related Weaknesses
The product contains hard-coded credentials, such as a password or cryptographic key.
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.