CVE-2021-23404: Cross Site Request Forgery (CSRF) vulnerability in sqlite-web
Summary
CVE-2021-23404: This affects all versions of package sqlite-web. Affects sqlite-web versions 0.1.1 – 0.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sqlite-web package is a Python package available on PyPI that provides a SQL dashboard for SQLite databases. It allows users to perform various actions on the database through a web interface. The package is widely used for managing SQLite databases in Python applications.
Vulnerability Detail
The SQL dashboard area of the sqlite-web package is vulnerable to Cross Site Request Forgery (CSRF) attacks. This means that an attacker can trick a user into unknowingly performing sensitive actions on the database. The package does not validate the origin of the request, allowing an attacker to forge requests and execute actions on behalf of the user. This vulnerability can have serious consequences, as an attacker can manipulate or delete data, perform unauthorized actions, or gain unauthorized access to the database.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to update to a fixed version of the sqlite-web package as soon as it becomes available.
Conclusion
The sqlite-web package is vulnerable to a Cross Site Request Forgery (CSRF) attack, which allows an attacker to perform unauthorized actions on the SQLite database. It is crucial to update to a fixed version of the package as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlite-web →
FAQ
This vulnerability allows an attacker to perform sensitive actions on the SQLite database without the user's knowledge or consent. This can lead to data manipulation, unauthorized access, and other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of writing, there is no fixed version of the sqlite-web package available. It is recommended to monitor the official repository and update to a fixed version as soon as it becomes available.
There are currently no known public exploits for this vulnerability. However, it is important to address this issue promptly to prevent any potential attacks.
Once a fixed version of the sqlite-web package is released, it is recommended to refer to the package's documentation for instructions on enabling and configuring CSRF protection. The documentation should provide detailed steps and examples.
