Headline
CVE-2021-43777: Build software better, together
Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery (CSRF) token, not a static and easily predicted value. This vulnerability does not affect users who do not use Google Login for their instance of Redash. A patch in the master and release/10.x.x branches addresses this by replacing Flask-Oauthlib with Authlib which automatically provides and validates a CSRF token for the state variable. The new implementation stores the next URL on the user session object. As a workaround, one may disable Google Login to mitigate the vulnerability.
Impact
If you do not use Google Login for your instance of Redash, this vulnerability does not affect you.
The current implementation of Google Login (via OAuth) incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a CSRF token, not a static and easily predicted value.
Our thanks to the reporter of this vulnerability, who wished to remain anonymous.
Patches
The current master and release/10.x.x branches address this by replacing Flask-Oauthlib with Authlib which automatically provides and validates a CSRF token for the state variable. The new implementation stores the next URL on the user session object.
Affected users should upgrade to V10.1. For Docker installations, you can upgrade to Docker Tag redash/redash:10.1.0.b50633.
Workarounds
Disabling Google Login will mitigate the vulnerability.
- First you should re-enable password login for your instance.
- Then disable Google login.
- After this, each user will need to reset their password from the log-in screen.
References
Redash Authentication Guide
Google’s Official guidance on the state token
For more information
If you have any questions or comments about this advisory:
- Open an issue in getredash/redash if you believe further development is needed.
- Start a thread in the forum.