CVE-2023-40570: Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users
Summary
CVE-2023-40570: Datasette is an open source multi-tool for exploring and publishing data. Affects datasette versions < 01e0558825b8f7ec17d3b691aa072daf122fcc74. Fixed in 01e0558825b8f7ec17d3b691aa072daf122fcc74. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Datasette is an open-source tool that allows users to explore and publish data. It provides a web interface for interacting with databases and tables. Datasette 1.0 alpha series refers to versions 1.0a0, 1.0a1, 1.0a2, and 1.0a3. These versions have a vulnerability that leaks the names of databases and tables to unauthenticated users. This issue affects Datasette instances that are accessible online but have authentication enabled using a plugin like datasette-auth-passwords.
Vulnerability Detail
The vulnerability in Datasette 1.0 alpha series allows unauthenticated users to access the /-/api API explorer endpoint and retrieve the names of databases and tables. Although the contents of the databases and tables are not exposed, this information disclosure can still be a security concern. An attacker could use this information to gain insights into the structure and organization of the data, potentially aiding in further attacks or unauthorized access.
How To Fix
Minimum fixed version
01e0558825b8f7ec17d3b691aa072daf122fcc74
This is the first release that contains the fix.
pip install --upgrade "datasette==01e0558825b8f7ec17d3b691aa072daf122fcc74"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Datasette 1.0a4 is not immediately feasible, a workaround is to block all traffic to the /-/api endpoint. This can be achieved by using a proxy server like Apache or NGINX to restrict access or by installing the datasette-block plugin. To use the plugin, add the following configuration to your metadata.json or metadata.yml file:
{
"plugins": {
"datasette-block": {
"prefixes": ["/-/api"]
}
}
}
Conclusion
Datasette 1.0 alpha series has a vulnerability that allows unauthenticated users to retrieve the names of databases and tables. Upgrading to Datasette version 1.0a4 or later is recommended to fix this issue. Alternatively, you can use a workaround to block access to the vulnerable endpoint. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for datasette →
FAQ
The vulnerability affects Datasette versions 1.0a0, 1.0a1, 1.0a2, and 1.0a3.
The impact of this vulnerability is that unauthenticated users can retrieve the names of databases and tables, potentially aiding in further attacks or unauthorized access.
No, the vulnerability only leaks the names of databases and tables. The contents of the databases and tables are not exposed.
To fix this vulnerability, upgrade to Datasette version 1.0a4 or later.
Yes, a workaround is to block all traffic to the /-/api endpoint using a proxy server or by installing the datasette-block plugin.
References
Related vulnerabilities
Recent vulnerabilities recorded for datasette.
