CVE-2021-32670 Reflected cross-site scripting issue in Datasette
Attackers can execute arbitrary scripts via the debug trace feature, potentially accessing protected data in authenticated Datasette installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32670?
CVE-2021-32670 is a high-severity cross-site scripting vulnerability in simonw datasette, published on 7 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
Weakness: CWE-79
Which versions are affected by CVE-2021-32670?
5 open source packages ship an affected version, including datasette. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
datasette PyPI | All versions | 0.56.1 |
datasette PyPI | All versions | 0.56.1 |
datasette PyPI | All versions | 0.56.1 |
datasette PyPI | All versions | 0.56.1 |
datasette PyPI | All versions | 0.56.1 |
Products include Datasette Datasette.
How do I fix CVE-2021-32670?
Upgrade datasette to 0.56.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-32670 being exploited?
There is no known exploitation of CVE-2021-32670 in the wild and no public exploit code.
Other vulnerabilities in simonw datasette
Sources
Also known as GHSA-gff3-739c-gxfq, GHSA-xw7c-jx9m-xh5g, PYSEC-2021-89.