Reflected Cross-Site Scripting Vulnerability in Datasette
Summary
CVE-2021-32670: Reflected cross-site scripting issue in Datasette. Affects datasette versions < 0.56.1. Fixed in 0.56.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Datasette is an open-source tool that allows users to explore and publish data as an interactive website. It provides a simple way to create and share databases with a focus on ease of use and collaboration. The tool is widely used for data analysis and visualization purposes. However, a vulnerability has been discovered in Datasette that could potentially allow an attacker to execute malicious scripts on a user's browser.
Vulnerability Detail
The vulnerability in Datasette is a reflected cross-site scripting (XSS) issue. When the ?_trace=1 debugging feature is enabled, Datasette fails to properly escape generated HTML, making it susceptible to XSS attacks. An attacker could exploit this vulnerability by tricking a user into clicking on a specially crafted link that contains malicious code. If the user is authenticated and the installation includes plugins like datasette-auth-passwords, the attacker could potentially access protected data.
How To Fix
Minimum fixed version
0.56.1
This is the first release that contains the fix.
pip install --upgrade "datasette==0.56.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If running Datasette behind a proxy, a temporary workaround is to reject any incoming requests with ?_trace= or &_trace= in their query string parameters. This can be done by configuring the proxy server to block or filter such requests. However, this workaround is not a permanent solution and should be used until the Datasette installation is updated to a patched version.
Conclusion
The reflected cross-site scripting vulnerability in Datasette can potentially allow attackers to execute malicious scripts and gain unauthorized access to protected data. It is crucial for Datasette users to update their installations to the patched versions (0.57 or 0.56.1) to mitigate this vulnerability. Additionally, running Datasette behind a proxy and implementing request filtering can provide a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for datasette →
FAQ
Datasette is an open-source tool that allows users to explore and publish data as an interactive website. It provides a simple way to create and share databases with a focus on ease of use and collaboration.
A reflected cross-site scripting vulnerability occurs when user-supplied data is not properly sanitized and is included in the HTML response sent to the user's browser. This allows an attacker to inject and execute malicious scripts in the context of the vulnerable website, potentially leading to unauthorized access or data theft.
An attacker can exploit the Datasette XSS vulnerability by crafting a malicious link that contains JavaScript code. When a user clicks on the link, the JavaScript code is executed in the user's browser, allowing the attacker to perform actions on behalf of the user or steal sensitive information.
No, only Datasette installations that have the ?_trace=1 debugging feature enabled are vulnerable to this XSS issue. It is recommended to disable this feature in production environments to mitigate the risk.
Apart from updating to a patched version of Datasette, running Datasette behind a proxy and rejecting requests with ?_trace= or &_trace= in their query string parameters can provide a temporary workaround. However, this should not be considered a permanent solution, and updating to a patched version is highly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for datasette.
