PT-2018-9567 · Luigi · Luigi

Publicado 2018-12-20 · Atualizado 2019-02-07 · CVE-2018-1000843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Luigi versions prior to 2.8.0

Description The issue concerns a Cross-Site Request Forgery (CSRF) vulnerability in the API endpoint: /api/<method>. This vulnerability can result in Task metadata, such as task name, id, parameter, etc., being leaked to unauthorized users. The attack appears to be exploitable via a specially crafted webpage that the victim must visit from the network where their Luigi server is accessible.

Recommendations For Luigi versions prior to 2.8.0, update to version 2.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /api/<method> API endpoint to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-1000843

GHSA-P69G-F978-XXV9

PYSEC-2018-11

Produtos afetados

Luigi

Referências · 11

• 🔥 https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67 · Exploit
• 🔥 https://github.com/spotify/luigi/pull/1870 · Exploit
• 🔥 https://groups.google.com/forum/#!topic/luigi-user/ZgfRTpBsVUY · Exploit
• https://github.com/spotify/luigi · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2018-11.yaml · Nota
• https://github.com/advisories/GHSA-p69g-f978-xxv9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000843 · Nota de Segurança
• https://groups.google.com/forum/#%21topic/luigi-user/ZgfRTpBsVUY · Nota
• https://osv.dev/vulnerability/CVE-2018-1000843 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2018-11 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p69g-f978-xxv9 · Aviso do Fabricante