CVE-2021-32670: Datasette Reflected Cross-Site Scripting Vulnerability
Summary
CVE-2021-32670: Datasette is an open source multi-tool for exploring and publishing data. Affects datasette versions < 0.56.1. Fixed in 0.56.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Datasette is an open source multi-tool for exploring and publishing data. It provides a web interface to interact with datasets, allowing users to explore and analyze data easily. The package is widely used for data exploration and sharing purposes. However, Datasette is vulnerable to a reflected cross-site scripting (XSS) attack when the ?_trace=1 debugging feature is enabled. This vulnerability allows an attacker to inject malicious code into the application, potentially leading to unauthorized access to protected data.
Vulnerability Detail
The ?_trace=1 debugging feature in Datasette does not properly escape generated HTML, making it susceptible to a reflected XSS attack. An attacker can craft a malicious URL containing JavaScript code, which will be executed in the context of the victim's browser when accessed. This can lead to various consequences, such as stealing sensitive information, performing actions on behalf of the victim, or modifying the content of the web page. The vulnerability is particularly critical if Datasette includes authenticated features using plugins like datasette-auth-passwords, as it could allow an attacker to access protected data.
How To Fix
Minimum fixed version
0.56.1
This is the first release that contains the fix.
pip install --upgrade "datasette==0.56.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If running Datasette behind a proxy, a temporary workaround is to reject any incoming requests with ?_trace= or &_trace= in their query string parameters. This can be achieved by configuring the proxy server to block or redirect such requests. However, this is not a permanent solution and upgrading to the patched versions is strongly advised.
Conclusion
The Datasette package is vulnerable to a reflected cross-site scripting (XSS) attack when the ?_trace=1 debugging feature is enabled. This can allow an attacker to inject and execute malicious code in the context of a user's browser, potentially leading to unauthorized access to protected data. The vulnerability has been patched in Datasette versions 0.57 and 0.56.1, and users are advised to upgrade to one of these versions to mitigate the risk. If running Datasette behind a proxy, a temporary workaround is available by rejecting requests with ?_trace= or &_trace= in their query string parameters. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for datasette →
FAQ
Datasette is an open source multi-tool for exploring and publishing data. It provides a web interface to interact with datasets, allowing users to explore and analyze data easily.
A reflected XSS attack is a type of web vulnerability where an attacker injects malicious code into a website, which is then executed in the victim's browser. This can lead to various consequences, such as stealing sensitive information or performing actions on behalf of the victim.
The Datasette XSS vulnerability allows an attacker to inject and execute malicious code in the context of a user's browser. This can potentially lead to unauthorized access to protected data if Datasette includes authenticated features using plugins like datasette-auth-passwords.
To fix the Datasette XSS vulnerability, it is recommended to upgrade to Datasette versions 0.57 or 0.56.1. Users can update their installation by running the command 'pip install --upgrade datasette'.
If running Datasette behind a proxy, a temporary workaround is to reject any incoming requests with '?_trace=' or '&_trace=' in their query string parameters. However, upgrading to the patched versions is strongly advised.
References
Related vulnerabilities
Recent vulnerabilities recorded for datasette.
