CVE-2021-32670: Reflected XSS in Datasette
Summary
CVE-2021-32670: Duplicate Advisory: Reflected cross-site scripting issue in Datasette. Affects datasette versions < 0.56.1. Fixed in 0.56.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Datasette is an open source multi-tool for exploring and publishing data. It provides various features for working with datasets and allows users to explore and visualize data. The vulnerability in Datasette arises from the ?_trace=1 debugging feature, which fails to properly escape generated HTML. This flaw can be exploited by an attacker to perform reflected cross-site scripting attacks. It is particularly concerning if Datasette includes authenticated features using plugins like datasette-auth-passwords, as the vulnerability could be used to access protected data.
Vulnerability Detail
The vulnerability in Datasette allows for reflected cross-site scripting attacks. When the ?_trace=1 debugging feature is used, the generated HTML is not properly escaped, enabling an attacker to inject malicious code into the application. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially compromising user data or performing unauthorized actions. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Minimum fixed version
0.56.1
This is the first release that contains the fix.
pip install --upgrade "datasette==0.56.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If Datasette is running behind a proxy, a temporary workaround is to reject any incoming requests with ?_trace= or &_trace= in their query string parameters. This can be achieved by configuring the proxy server to block or filter such requests. However, applying the official patch by updating Datasette to a patched version is the recommended solution.
Conclusion
The vulnerability in Datasette allows for reflected cross-site scripting attacks, which can lead to the execution of arbitrary JavaScript code in the context of the victim's browser. To mitigate this risk, it is crucial to update Datasette to version 0.57 or 0.56.1, both of which include patches for this issue. Additionally, if Datasette is running behind a proxy, configuring the proxy server to reject requests with ?_trace= or &_trace= can provide a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for datasette →
FAQ
Datasette is an open source multi-tool for exploring and publishing data. It provides a user-friendly interface for working with datasets and offers various features for data exploration and visualization.
Reflected cross-site scripting (XSS) is a type of web vulnerability where an attacker injects malicious code into a website, which is then executed by the victim's browser. In the case of Datasette, the vulnerability allows an attacker to inject and execute arbitrary JavaScript code in the context of the user's browser.
The Datasette vulnerability can be exploited by an attacker who tricks a user into visiting a specially crafted URL that includes the ?_trace=1 parameter. When the user accesses the vulnerable Datasette instance, the injected JavaScript code is executed in their browser, potentially leading to data theft, session hijacking, or other malicious activities.
No, only Datasette versions prior to 0.56.1 are affected by this vulnerability. The issue has been addressed in Datasette 0.57 and 0.56.1, which include patches to properly escape the generated HTML and prevent cross-site scripting attacks.
Yes, if Datasette is running behind a proxy, a temporary workaround is to configure the proxy server to reject any incoming requests with ?_trace= or &_trace= in their query string parameters. However, it is strongly recommended to apply the official patch by updating Datasette to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for datasette.
