CVE-2021-43780 : What You Need to Know
Learn about CVE-2021-43780 impacting Redash versions <= 10.0.0. Understand the SSRF vulnerability, its impact, affected systems, and mitigation steps.
Redash is a package for data visualization and sharing. In versions 10.0 and prior, the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server-Side Request Forgery (SSRF). This vulnerability can be exploited on installations with URL-loading data sources enabled. Upgrading to version 10.0.1 is recommended to address this issue. This CVE has a CVSS base score of 6.8 (Medium severity).
Understanding CVE-2021-43780
Redash is susceptible to Server-Side Request Forgery (SSRF) vulnerabilities, impacting confidentiality and integrity with a Low privileges required.
What is CVE-2021-43780?
Redash, in versions 10.0 and prior, allows SSRF exploitation through URL-loading data sources, affecting data integrity and confidentiality.
The Impact of CVE-2021-43780
- Attack Complexity: High
- Attack Vector: Network
- Confidentiality Impact: High
- Integrity Impact: High
- Privileges Required: Low
Technical Details of CVE-2021-43780
The vulnerability lies in the handling of URL-loading data sources within Redash.
Vulnerability Description
- Redash versions <= 10.0.0 are susceptible to SSRF via URL-loading data sources like JSON, CSV, or Excel.
Affected Systems and Versions
- Product: Redash
- Vendor: getredash
- Versions Affected: <= 10.0.0
Exploitation Mechanism
- Vulnerable installations with URL-loading data sources enabled can be exploited.
Mitigation and Prevention
It is crucial to take immediate steps to secure Redash installations.
Immediate Steps to Take
- Upgrade to version 10.0.1 to apply the necessary patch.
- Disable vulnerable data sources by adding specific environment variables to the configuration.
- Switch certain data sources to 'View Only' mode for all groups.
- Modify Redash's configuration through environment variables.
Long-Term Security Practices
- Regularly update Redash to the latest secure versions.
- Implement and enforce secure coding practices within the organization.
Patching and Updates
- Upgrade to Redash version 10.0.1 or newer to fix the SSRF vulnerability.