CVE-2024-3408

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.

• CWE-798
• CWE-94
• CWE-798

• https://github.com/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13
• https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91Exploit, Third Party Advisory
• https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91Exploit, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34073sagemaker-python-sdk is a library for training and deploying…7.8
• CVE-2024-34074Frappe is a full-stack web application framework. Prior to 1…6.1
• CVE-2024-34075kurwov is a fast, dependency-free library for creating Marko…6.2
• CVE-2024-34077MantisBT (Mantis Bug Tracker) is an open source issue tracke…7.3
• CVE-2024-34078html-sanitizer is an allowlist-based HTML cleaner. If using …6.1
• CVE-2024-34079octo-sts is a GitHub App that acts like a Security Token Ser…3.7
• CVE-2024-34080MantisBT (Mantis Bug Tracker) is an open source issue tracke…5.3
• CVE-2024-34081MantisBT (Mantis Bug Tracker) is an open source issue tracke…4.8
• CVE-2024-34082Grav is a file-based Web platform. Prior to version 1.7.46, …9.9
• CVE-2024-34083aiosmptd is a reimplementation of the Python stdlib smtpd.p…5.4
• CVE-2024-34084Minder's `HandleGithubWebhook` is susceptible to a denial of…7.5
• CVE-2024-34085A vulnerability has been identified in JT2Go (All versions <…7.8