GHSA-7hfx-h3j3-rwq4: D-Tale server-side request forgery through Web uploads

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-21642

D-Tale server-side request forgery through Web uploads

Moderate severity GitHub Reviewed Published Jan 5, 2024 in man-group/dtale

Affected versions

< 3.9.0

Description

Impact

Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.

Patches

Users should upgrade to version 3.9.0 where the “Load From the Web” input is turned off by default. You can find out more information on how to turn it back on here

Workarounds

The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.

References

See “Load Data & Sample Datasets” documentation

References

• GHSA-7hfx-h3j3-rwq4
• man-group/dtale@954f6be

Published to the GitHub Advisory Database

Jan 5, 2024