PT-2021-23926 · Google · Google Login

Published 2021-11-23 · Updated 2024-03-06 · CVE-2021-43777

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Redash versions 10.0 and prior

Description: The implementation of Google Login in Redash incorrectly uses the state parameter to pass the next URL to redirect the user to after login, instead of using it for a Cross-Site Request Forgery (CSRF) token. This issue does not affect users who do not use Google Login for their instance of Redash. A patch addresses this by replacing Flask-Oauthlib with Authlib, which automatically provides and validates a CSRF token for the state variable, and stores the next URL on the user session object.

Recommendations: For Redash versions 10.0 and prior, update to a version that includes the patch in the master and release/10.x.x branches to replace Flask-Oauthlib with Authlib. As a temporary workaround, consider disabling Google Login to mitigate the vulnerability.

Fix

Open Redirect

CSRF

Weakness Enumeration

CWE-601

CWE-352

Related Identifiers

BIT-REDASH-2021-43777

CVE-2021-43777

GHSA-VHC7-W7R8-8M34

Affected Products

Google Login

References · 6

• https://github.com/getredash/redash/commit/da696ff7f84787cbf85967460fac52886cbe063e · Patch
• https://osv.dev/vulnerability/CVE-2021-43777 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redash-2021-43777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43777 · Security Note
• https://github.com/getredash/redash/security/advisories/GHSA-vhc7-w7r8-8m34 · Note
• https://t.me/cibsecurity/32960 · Telegram Post