Vulnerability-Lookup

CNVD-2021-95242

Vulnerability from cnvd - Published: 2021-12-08

Title

Redash代码问题漏洞（CNVD-2021-95242）

Description

Redash是以色列Redash公司的一套数据整合分析解决方案。该产品支持数据整合、数据可视化、查询编辑和数据共享等。 Redash 10.0.0及之前版本存在代码问题漏洞，该漏洞源于程序在加载JSON、CSV或Excel等url数据源时容易受到服务器端请求伪造的的攻击。目前没有详细漏洞细节提供。

Severity

中

Patch Name

Redash代码问题漏洞（CNVD-2021-95242）的补丁

Patch Description

Redash是以色列Redash公司的一套数据整合分析解决方案。该产品支持数据整合、数据可视化、查询编辑和数据共享等。 Redash 10.0.0及之前版本存在代码问题漏洞，该漏洞源于程序在加载JSON、CSV或Excel等url数据源时容易受到服务器端请求伪造的的攻击。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-43780

Impacted products

Name
Redash Redash <=10.0.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-43780"
    }
  },
  "description": "Redash\u662f\u4ee5\u8272\u5217Redash\u516c\u53f8\u7684\u4e00\u5957\u6570\u636e\u6574\u5408\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u6570\u636e\u6574\u5408\u3001\u6570\u636e\u53ef\u89c6\u5316\u3001\u67e5\u8be2\u7f16\u8f91\u548c\u6570\u636e\u5171\u4eab\u7b49\u3002\n\nRedash 10.0.0\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u52a0\u8f7dJSON\u3001CSV\u6216Excel\u7b49url\u6570\u636e\u6e90\u65f6\u5bb9\u6613\u53d7\u5230\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u7684\u7684\u653b\u51fb\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-95242",
  "openTime": "2021-12-08",
  "patchDescription": "Redash\u662f\u4ee5\u8272\u5217Redash\u516c\u53f8\u7684\u4e00\u5957\u6570\u636e\u6574\u5408\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u6570\u636e\u6574\u5408\u3001\u6570\u636e\u53ef\u89c6\u5316\u3001\u67e5\u8be2\u7f16\u8f91\u548c\u6570\u636e\u5171\u4eab\u7b49\u3002\r\n\r\nRedash 10.0.0\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u52a0\u8f7dJSON\u3001CSV\u6216Excel\u7b49url\u6570\u636e\u6e90\u65f6\u5bb9\u6613\u53d7\u5230\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u7684\u7684\u653b\u51fb\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Redash\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2021-95242\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Redash Redash \u003c=10.0.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-43780",
  "serverity": "\u4e2d",
  "submitTime": "2021-11-25",
  "title": "Redash\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2021-95242\uff09"
}

CVE-2021-43780 (GCVE-0-2021-43780)

Vulnerability from cvelistv5 – Published: 2021-11-23 23:55 – Updated: 2024-08-04 04:03

Title

Server-Side Request Forgery (SSRF) in Redash

Summary

Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. As of time of publication, the `master` and `release/10.x.x` branches address this by applying the Advocate library for making http requests instead of the requests library directly. Users should upgrade to version 10.0.1 to receive this patch. There are a few workarounds for mitigating the vulnerability without upgrading. One can disable the vulnerable data sources entirely, by adding the following env variable to one's configuration, making them unavailable inside the webapp. One can switch any data source of certain types (viewable in the GitHub Security Advisory) to be `View Only` for all groups on the Settings > Groups > Data Sources screen. For users unable to update an admin may modify Redash's configuration through environment variables to mitigate this issue. Depending on the version of Redash, an admin may also need to run a CLI command to re-encrypt some fields in the database. The `master` and `release/10.x.x` branches as of time of publication have removed the default value for `REDASH_COOKIE_SECRET`. All future releases will also require this to be set explicitly. For existing installations, one will need to ensure that explicit values are set for the `REDASH_COOKIE_SECRET` and `REDASH_SECRET_KEY `variables.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/getredash/redash/security/advi…	x_refsource_CONFIRM
https://github.com/getredash/redash/commit/61bbb5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getredash	redash	Affected: <= 10.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:08.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/getredash/redash/commit/61bbb5aa7a23a93f2f93710005f71bc972826099"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redash",
          "vendor": "getredash",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 10.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. As of time of publication, the `master` and `release/10.x.x` branches address this by applying the Advocate library for making http requests instead of the requests library directly. Users should upgrade to version 10.0.1 to receive this patch. There are a few workarounds for mitigating the vulnerability without upgrading. One can disable the vulnerable data sources entirely, by adding the following env variable to one\u0027s configuration, making them unavailable inside the webapp. One can switch any data source of certain types (viewable in the GitHub Security Advisory) to be `View Only` for all groups on the Settings \u003e Groups \u003e Data Sources screen. For users unable to update an admin may modify Redash\u0027s configuration through environment variables to mitigate this issue. Depending on the version of Redash, an admin may also need to run a CLI command to re-encrypt some fields in the database. The `master` and `release/10.x.x` branches as of time of publication have removed the default value for `REDASH_COOKIE_SECRET`. All future releases will also require this to be set explicitly. For existing installations, one will need to ensure that explicit values are set for the `REDASH_COOKIE_SECRET` and `REDASH_SECRET_KEY `variables."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-23T23:55:09.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getredash/redash/commit/61bbb5aa7a23a93f2f93710005f71bc972826099"
        }
      ],
      "source": {
        "advisory": "GHSA-fcpv-hgq6-87h7",
        "discovery": "UNKNOWN"
      },
      "title": "Server-Side Request Forgery (SSRF) in Redash",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-43780",
          "STATE": "PUBLIC",
          "TITLE": "Server-Side Request Forgery (SSRF) in Redash"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redash",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 10.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "getredash"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. As of time of publication, the `master` and `release/10.x.x` branches address this by applying the Advocate library for making http requests instead of the requests library directly. Users should upgrade to version 10.0.1 to receive this patch. There are a few workarounds for mitigating the vulnerability without upgrading. One can disable the vulnerable data sources entirely, by adding the following env variable to one\u0027s configuration, making them unavailable inside the webapp. One can switch any data source of certain types (viewable in the GitHub Security Advisory) to be `View Only` for all groups on the Settings \u003e Groups \u003e Data Sources screen. For users unable to update an admin may modify Redash\u0027s configuration through environment variables to mitigate this issue. Depending on the version of Redash, an admin may also need to run a CLI command to re-encrypt some fields in the database. The `master` and `release/10.x.x` branches as of time of publication have removed the default value for `REDASH_COOKIE_SECRET`. All future releases will also require this to be set explicitly. For existing installations, one will need to ensure that explicit values are set for the `REDASH_COOKIE_SECRET` and `REDASH_SECRET_KEY `variables."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-918: Server-Side Request Forgery (SSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7",
              "refsource": "CONFIRM",
              "url": "https://github.com/getredash/redash/security/advisories/GHSA-fcpv-hgq6-87h7"
            },
            {
              "name": "https://github.com/getredash/redash/commit/61bbb5aa7a23a93f2f93710005f71bc972826099",
              "refsource": "MISC",
              "url": "https://github.com/getredash/redash/commit/61bbb5aa7a23a93f2f93710005f71bc972826099"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-fcpv-hgq6-87h7",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-43780",
    "datePublished": "2021-11-23T23:55:10.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T04:03:08.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.