A business intelligence tool exists to hold database credentials. That is not a side effect to be hardened later; it is the function. DataEase follows the pattern, accepts a JDBC connection string, stores it, and renders the results to whoever opens a dashboard. When the number of reachable instances runs into four figures, the question is what those stored connections reach.

Query results

Measured through ZoomEye on 2026-10-23, page size one, all sub-types:

  • app="DataEase" returned 9,832.

  • title="DataEase" returned 1,246.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJEYXRhRWFzZSI%3D

An eightfold gap between fingerprint and title is the largest in this series, and for a self-hosted BI product it is plausible. Deployments are commonly served under a path prefix behind a corporate gateway, embedded in a portal, or customised with the organisation's own name in the page title. The fingerprint follows the application's behaviour rather than its branding, so it reaches those deployments while the title query does not.

The practical consequence for a defender is a familiar one by now: searching for the vendor name finds a fraction of the estate. The fingerprint figure is the number to plan against, and it understates a population where deployments are deliberately quiet.

What the datasource form holds

A BI platform's value is its connection registry. Each entry pairs a host, a port, a database name, a username and a password, and the application needs all of them in recoverable form to run a query on demand. In most deployments they sit in the application database, encrypted with a key that is also on the same host, which means the encryption protects against a stolen backup rather than against an intruder who reaches the application.

The reach of a single entry is the part that gets underestimated. A JDBC connection to a warehouse is not a read-only view; it is whatever the account grants. Analysts who need to query often receive accounts with broad rights because narrowing them breaks dashboards, and the resulting credential frequently reaches beyond the schema the dashboard displays.

The three paths that matter

  • Datasource enumeration through the interface. An account with access to the datasource management page can list connections, and on several versions can test them. A test that connects proves reachability from the application server, which is reconnaissance against the internal network from a position inside it.

  • Query construction. The BI interface builds SQL. Where a filter or calculation is passed into that construction without parameterisation, a dashboard becomes a query injection point, and the injection runs with the credentials the datasource holds.

  • Embedded dashboards. Public links and iframe embeds are designed to be reachable without a full session. The token in the link is the control, and a link pasted into a public channel is a link that works for anyone.

None of those require the attacker to understand the business. They require the ability to reach a login page and, in some cases, a link someone already shared.

Why this population grew quickly

Data visualisation tools spread through an organisation by demonstration. One team installs a self-hosted option, builds a dashboard, and shows it to another team, which installs its own because onboarding to the first one takes a ticket. Within a year there are a dozen instances, several with overlapping datasource credentials and none with a shared owner.

The measurement reflects that dynamic. Nine thousand fingerprinted deployments is not a population of nine thousand deliberate decisions; it is a population of small decisions that each looked reasonable.

Reviewing an instance

  • Inventory datasource entries and the privilege each credential actually holds, then narrow accounts that reach more than their dashboards need.

  • Remove test-connection capability from roles that do not administer datasources, since the test is a port scan from the inside.

  • Expire public share links, and audit which embed tokens are still valid.

  • Move datasource credentials into a secret reference resolved at query time rather than a value stored in the application database.

  • Restrict outbound reachability from the BI host to the database hosts it must query, so a compromised instance cannot roam.

Limitations

ZoomEye totals are an observation window, not a census, and they move between queries. A fingerprint hit identifies an application answering on an address; it does not reveal whether the instance requires authentication, how many datasources are configured, what privileges those credentials hold, or which version is deployed.

References

  • ZoomEye application fingerprint query for DataEase, run 2026-10-23, total 9,832.

  • ZoomEye title query for DataEase, run 2026-10-23, total 1,246.

  • DataEase documentation covering datasource management, sharing and embedded dashboards.