Lightdash 0.510.3 export insertion of sensitive information into sent data

Summaryinfo

A vulnerability was found in Lightdash. It has been classified as problematic. The impacted element is an unknown function of the file /api/v1/dashboards/export. The manipulation leads to insertion of sensitive information into sent data. This vulnerability is traded as CVE-2024-6586. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Lightdash. This issue affects an unknown code block of the file /api/v1/dashboards/export. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. Using CWE to declare the problem leads to CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.

The weakness was shared by Kenneth Chiong as GHSA-4h7x-6vxh-7hjf. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-6586 since 07/08/2024. The exploitation is known to be easy. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 0.1027.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Lightdash

Version

• 0.510.3

Website

• Product: https://github.com/lightdash/lightdash/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion