CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43780 – Server-Side Request Forgery (SSRF) in Redash
https://notcve.org/view.php?id=CVE-2021-43780
Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. As of time of publication, the `master` and `release/10.x.x` branches address this by applying the Advocate library for making http requests instead of the requests library directly. Users should upgrade to version 10.0.1 to receive this patch. • https://github.com/getredash/redash/commit/61bbb5aa7a23a93f2f93710005f71bc972826099 https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-41192 – Insecure default configuration
https://notcve.org/view.php?id=CVE-2021-41192
Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. • https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv https://ian.sh/redash • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43777 – Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)
https://notcve.org/view.php?id=CVE-2021-43777
Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `state` parameter to pass the next URL to redirect the user to after login. The `state` parameter should be used for a Cross-Site Request Forgery (CSRF) token, not a static and easily predicted value. This vulnerability does not affect users who do not use Google Login for their instance of Redash. A patch in the `master` and `release/10.x.x` branches addresses this by replacing `Flask-Oauthlib` with `Authlib` which automatically provides and validates a CSRF token for the state variable. • https://github.com/getredash/redash/commit/da696ff7f84787cbf85967460fac52886cbe063e https://github.com/getredash/redash/security/advisories/GHSA-vhc7-w7r8-8m34 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36144
https://notcve.org/view.php?id=CVE-2020-36144
Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization. Redash versión 8.0.0 está afectado por LDAP Injection. Existe una fuga de información a través de la elaboración de consultas especiales, escapando de la plantilla proporcionada ya que el nombre de usuario incluido en el filtro de búsqueda carece de sanitización • https://github.com/getredash/redash/issues/5426 https://github.com/getredash/redash/releases • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-12725
https://notcve.org/view.php?id=CVE-2020-12725
Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding headers, selecting any HTTP verb, etc. Havoc Research detectó una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) autenticada por medio de la fuente de datos "JSON" de Redash de código abierto versiones 8.0.0 y anteriores. Posiblemente, otros conectores están afectados. • https://blog.redash.io https://github.com/getredash/redash/commits/master https://github.com/getredash/redash/issues/4869 • CWE-918: Server-Side Request Forgery (SSRF) •