PT-2024-22367 · Querybook · Querybook

Hakupiku · Published 2024-03-13 · Updated 2025-09-04 · CVE-2024-28251

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Querybook versions prior to 3.32.0

Description The issue concerns Querybook, a Big Data Querying UI that combines collocated table metadata and a simple notebook interface. Querybook's datadocs functionality uses a Websocket Server, allowing clients to update, delete, read cells, and watch the live status of query executions. The CORS setting currently allows all origins, which could result in cross-site websocket hijacking, enabling attackers to read, edit, or remove datadocs of the user.

Recommendations For versions prior to 3.32.0, upgrade to version 3.32.0 to address the issue. As a temporary workaround, consider restricting access to the Websocket Server to minimize the risk of exploitation. Avoid using the datadocs functionality until the issue is resolved.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-28251

GHSA-5349-J4C9-X767

Affected Products

Querybook

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28251.json · Exploit
• https://github.com/pinterest/querybook/security/advisories/GHSA-5349-j4c9-x767 · Vendor Advisory
• https://github.com/pinterest/querybook/pull/1425 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-28251 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28251 · Vendor Advisory
• https://twitter.com/CVEnew/status/1768213795393175728 · Twitter Post
• https://t.me/cveNotify/134276 · Telegram Post
• https://t.me/cvenotify/73766 · Telegram Post