PT-2022-27768 · Querybook · Querybook

Czgupublished + 1 · Published 2022-12-06 · Updated 2022-12-07 · CVE-2022-46151

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Querybook versions prior to 3.14.2

Description The issue concerns Querybook, an open source data querying UI. In affected versions, user-provided data is not escaped in the error field of the auth callback URL in querybook/server/app/auth/oauth auth.py and querybook/server/app/auth/okta auth.py. This may allow attackers to perform reflected cross-site scripting (XSS) if Content Security Policy (CSP) is not enabled or unsafe-inline is allowed.

Recommendations For versions prior to 3.14.2, upgrade to the latest, patched version of Querybook (version 3.14.2 or greater). For users unable to upgrade, enable Content Security Policy (CSP) and do not allow unsafe-inline, or manually escape query parameters in a reverse proxy.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46151

GHSA-MRRW-9WF7-XQ6W

Affected Products

Querybook

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46151.json · Exploit
• https://github.com/pinterest/querybook/commit/88a7f10495bf5ed1a556ade51a2f2794e403c063 · Patch
• https://osv.dev/vulnerability/CVE-2022-46151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46151 · Security Note
• https://github.com/pinterest/querybook/security/advisories/GHSA-mrrw-9wf7-xq6w · Note
• https://t.me/cibsecurity/54047 · Telegram Post
• https://t.me/cvenotify/39226 · Telegram Post
• https://t.me/cvenotify/39347 · Telegram Post