CVE-2024-6586 (GCVE-0-2024-6586)
Vulnerability from cvelistv5 – Published: 2024-08-30 22:25 – Updated: 2024-09-03 14:50
VLAI?
Summary
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.
Severity ?
7.3 (High)
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
Impacted products
Credits
Kenneth Chiong, Mandiant
Kenneth Chiong, Mandiant
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "lightdash",
"vendor": "lightdash",
"versions": [
{
"lessThan": "0.1027.2",
"status": "affected",
"version": "0.1024.6",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-6586",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:48:51.247263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:50:25.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Lightdash",
"vendor": "Lightdash",
"versions": [
{
"changes": [
{
"at": "0.1027.2",
"status": "unaffected"
}
],
"lessThan": "0.1027.2",
"status": "affected",
"version": "0.1024.6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenneth Chiong, Mandiant"
},
{
"lang": "en",
"type": "reporter",
"value": "Kenneth Chiong, Mandiant"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
}
],
"value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T22:25:48.431Z",
"orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
"shortName": "Mandiant"
},
"references": [
{
"url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"
},
{
"url": "https://github.com/lightdash/lightdash"
},
{
"url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"
},
{
"url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"
},
{
"url": "https://github.com/lightdash/lightdash/pull/9295"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
"assignerShortName": "Mandiant",
"cveId": "CVE-2024-6586",
"datePublished": "2024-08-30T22:25:48.431Z",
"dateReserved": "2024-07-08T21:24:57.730Z",
"dateUpdated": "2024-09-03T14:50:25.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.\"}, {\"lang\": \"es\", \"value\": \"La versi\\u00f3n 0.1024.6 de Lightdash permite a los usuarios con los permisos necesarios, como Administrador o Editor, crear y compartir paneles. Un panel que contiene elementos HTML que apuntan a una fuente controlada por un actor de amenazas puede activar una solicitud SSRF cuando se exporta, a trav\\u00e9s de una solicitud POST a /api/v1/dashboards//export. La solicitud falsificada contiene el valor del token de sesi\\u00f3n del usuario exportador. Un actor de amenazas podr\\u00eda obtener el token de sesi\\u00f3n de cualquier usuario que exporte el panel. El token de sesi\\u00f3n obtenido se puede utilizar para realizar acciones como v\\u00edctima en la aplicaci\\u00f3n, lo que da como resultado la toma de control de la sesi\\u00f3n.\"}]",
"id": "CVE-2024-6586",
"lastModified": "2024-09-03T15:35:16.577",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 5.2}]}",
"published": "2024-08-30T23:15:12.747",
"references": "[{\"url\": \"https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf\", \"source\": \"mandiant-cve@google.com\"}, {\"url\": \"https://github.com/lightdash/lightdash\", \"source\": \"mandiant-cve@google.com\"}, {\"url\": \"https://github.com/lightdash/lightdash/pull/9295\", \"source\": \"mandiant-cve@google.com\"}, {\"url\": \"https://github.com/lightdash/lightdash/releases/tag/0.1027.2\", \"source\": \"mandiant-cve@google.com\"}, {\"url\": \"https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch\", \"source\": \"mandiant-cve@google.com\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-6586\", \"source\": \"mandiant-cve@google.com\"}]",
"sourceIdentifier": "mandiant-cve@google.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"mandiant-cve@google.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-201\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-6586\",\"sourceIdentifier\":\"mandiant-cve@google.com\",\"published\":\"2024-08-30T23:15:12.747\",\"lastModified\":\"2024-09-03T15:35:16.577\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.\"},{\"lang\":\"es\",\"value\":\"La versi\u00f3n 0.1024.6 de Lightdash permite a los usuarios con los permisos necesarios, como Administrador o Editor, crear y compartir paneles. Un panel que contiene elementos HTML que apuntan a una fuente controlada por un actor de amenazas puede activar una solicitud SSRF cuando se exporta, a trav\u00e9s de una solicitud POST a /api/v1/dashboards//export. La solicitud falsificada contiene el valor del token de sesi\u00f3n del usuario exportador. Un actor de amenazas podr\u00eda obtener el token de sesi\u00f3n de cualquier usuario que exporte el panel. El token de sesi\u00f3n obtenido se puede utilizar para realizar acciones como v\u00edctima en la aplicaci\u00f3n, lo que da como resultado la toma de control de la sesi\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"mandiant-cve@google.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]}],\"references\":[{\"url\":\"https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf\",\"source\":\"mandiant-cve@google.com\"},{\"url\":\"https://github.com/lightdash/lightdash\",\"source\":\"mandiant-cve@google.com\"},{\"url\":\"https://github.com/lightdash/lightdash/pull/9295\",\"source\":\"mandiant-cve@google.com\"},{\"url\":\"https://github.com/lightdash/lightdash/releases/tag/0.1027.2\",\"source\":\"mandiant-cve@google.com\"},{\"url\":\"https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch\",\"source\":\"mandiant-cve@google.com\"},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-6586\",\"source\":\"mandiant-cve@google.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6586\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-03T14:48:51.247263Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*\"], \"vendor\": \"lightdash\", \"product\": \"lightdash\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.1024.6\", \"lessThan\": \"0.1027.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-03T14:50:16.434Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Kenneth Chiong, Mandiant\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Kenneth Chiong, Mandiant\"}], \"affected\": [{\"vendor\": \"Lightdash\", \"product\": \"Lightdash\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"0.1027.2\", \"status\": \"unaffected\"}], \"version\": \"0.1024.6\", \"lessThan\": \"0.1027.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-6586\"}, {\"url\": \"https://github.com/lightdash/lightdash\"}, {\"url\": \"https://github.com/lightdash/lightdash/releases/tag/0.1027.2\"}, {\"url\": \"https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch\"}, {\"url\": \"https://github.com/lightdash/lightdash/pull/9295\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201 Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"shortName\": \"Mandiant\", \"dateUpdated\": \"2024-08-30T22:25:48.431Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-6586\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-03T14:50:25.611Z\", \"dateReserved\": \"2024-07-08T21:24:57.730Z\", \"assignerOrgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"datePublished\": \"2024-08-30T22:25:48.431Z\", \"assignerShortName\": \"Mandiant\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…