CVE-2021-41192 Information

Description

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables a default value is used for both that is the same across all installations. In such cases the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images Redash’s Digital Ocean marketplace droplets or the scripts in the getredash/setup repository. These instances automatically generate unique secret keys during installation. One can verify whether one’s instance is affected by checking the value of the REDASH_COOKIE_SECRET environment variable. If it is c292a0a3aa32397cdb050e233733900f should follow the steps to secure the instance outlined in the GitHub Security Advisory.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Reference

https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 https://ian.sh/redash

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

6.5