CVE-2018-1000843: Luigi Cross-Site Request Forgery (CSRF) Vulnerability
Summary
CVE-2018-1000843: Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/ that c... Affects luigi versions < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Luigi is an open-source Python package that helps build complex pipelines of batch jobs. It provides a framework for defining tasks and dependencies between them, making it easier to manage and execute data workflows. Luigi is widely used in data engineering and data science projects.
Vulnerability Detail
The Luigi version prior to 2.8.0, after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb, and after GitHub PR spotify/luigi/pull/1870 contains a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability exists in the API endpoint: /api/<method>. An attacker can exploit this vulnerability by tricking a victim into visiting a specially crafted webpage from the network where their Luigi server is accessible. As a result, task metadata such as task name, ID, parameters, etc., will be leaked to unauthorized users. This can lead to unauthorized access and potential data exposure.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
pip install --upgrade "luigi==2.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Luigi to mitigate the risk.
Conclusion
The Luigi version prior to 2.8.0 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. Upgrading to version 2.8.0 or later is necessary to fix this vulnerability and prevent unauthorized access to task metadata. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for luigi →
FAQ
Luigi is an open-source Python package used for building complex data workflows and managing dependencies between tasks.
A CSRF vulnerability allows an attacker to perform unwanted actions on behalf of a victim user by tricking them into executing malicious requests.
The vulnerability can be exploited by tricking a victim into visiting a specially crafted webpage from the network where their Luigi server is accessible.
The vulnerability can lead to unauthorized access and exposure of task metadata, which may include sensitive information.
No, there is no known workaround. It is recommended to upgrade to the fixed version of Luigi.
Related vulnerabilities
Recent vulnerabilities recorded for luigi.
