# CVE-2024-3408: Man-group/dtale - Information Disclosure

> Live exploitation tracking for CVE-2024-3408 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-3408

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Man-group dtale
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials); CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** python, web_application

## Description

Man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.

## CrowdSec analysis

[CVE-2024-3408](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-3408) is a critical vulnerability in Man-group/dtale version 3.10.0 that allows attackers to bypass authentication and achieve remote code execution due to a hardcoded SECRET_KEY and improper input validation. By forging session cookies and exploiting insufficient restrictions on custom filter queries, unauthenticated attackers can gain full control over the affected server. This flaw poses a severe risk of information disclosure, data manipulation, and system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec network observations suggest that most exploitation of CVE-2024-3408 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2024-3408. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit D-Tale instances by forging session cookies to bypass authentication and then interact with endpoints such as `/dtale/popup/upload`, `/dtale/upload`, `/dtale/update-settings/`, and `/dtale/test-filter/` to achieve remote code execution. These attack patterns involve sending crafted requests with a hardcoded session cookie and leveraging the vulnerable endpoints to execute arbitrary commands on the server.

## Timeline

- 2024-06-06: CVE Published. CVE-2024-3408 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2024-3408 exploitation attempts against the CrowdSec Network.
- 2026-04-01: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-3408 for the first time.

## References

- https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91
- https://github.com/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3408.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-3408) follows observed exploitation activity for CVE-2024-3408. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.