Skip to content

Reflected XSS

Moderate
czgu published GHSA-mrrw-9wf7-xq6w Dec 5, 2022

Package

querybook/querybook (dockerhub)

Affected versions

<3.14.2

Patched versions

3.14.2

Description

Impact

User provided data is not escaped in the error field of the auth callback url in querybook/server/app/auth/oauth_auth.py and querybook/server/app/auth/okta_auth.py. This may allow attackers to perform reflected XSS if CSP (Content Security Policy) is not enabled or unsafe-inline is allowed.

Patches

  • Upgrade to the latest, patched version of querybook (version 3.14.2 or greater)

Workarounds

  • Enable CSP and do not allow unsafe-inline
  • Escape query parameters in a reverse proxy
  • WAF could be helpful but is unreliable (see here)

References

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
5.5
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE ID

CVE-2022-46151

Weaknesses