GHSA-q6j3-c4wc-63vw CSRF tokens leaked in URL by canned query form
Read-only form submissions leak CSRF tokens in URLs, potentially exposing them to attackers via referrer headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-q6j3-c4wc-63vw?
GHSA-q6j3-c4wc-63vw is a vulnerability in datasette, published on 11 Aug 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
The HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698).
This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhood_search submitting the form took me to:
https://latest.datasette.io/fixtures/neighborhood_search?text=down&csrftoken=CSRFTOKEN-HERE
This token could potentially leak to an attacker if the resulting page has a link to an external site on it and the user clicks the link, since the token would be exposed in the referral logs.
Patches
A fix for this issue has been released in Datasette 0.46.
Workarounds
You can fix this issue in a Datasette instance without upgrading by copying the 0.46 query.html template into a custom templates/ directory and running Datasette with the --template-dir=templates/ option.
References
Issue 918 discusses this in details: https://github.com/simonw/datasette/issues/918
For more information
Contact swillison at gmail with any questions.
Which versions are affected by GHSA-q6j3-c4wc-63vw?
2 open source packages ship an affected version, including datasette.
| Package | Affected | Fixed in |
|---|---|---|
datasette PyPI | All versions | 0.46 |
datasette PyPI | All versions | 0.46 |
How do I fix GHSA-q6j3-c4wc-63vw?
Upgrade datasette to 0.46 or later.
Is GHSA-q6j3-c4wc-63vw being exploited?
There is no known exploitation of GHSA-q6j3-c4wc-63vw in the wild and no public exploit code.