GHSA-h6fw-x63x-9gr6: Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lightdashto a version that resolves this vulnerability.Fixed in 3.137.0
Event History
Frequently Asked Questions
Which users are able to exploit this issue?
An authenticated user needs update Project permission on at least one project. The vulnerable endpoints can then be used with crafted requests against dashboards in a different project.
What information and changes can an attacker access?
An attacker can use the rename/dashboard/fields endpoint to read field metadata from projects they cannot access. They can use the rename/dashboard endpoint to modify filters on foreign dashboards, potentially breaking charts.
Are unaffected project permissions sufficient to prevent cross-project access?
No. The authorization failure occurs because the RenameService does not verify that the projectUuid in the URL matches the target dashboard's projectUuid, so permission on one project can be leveraged against another project.
What version should be used to remediate the issue?
Upgrade to Lightdash 3.137.0 or later. The affected range is Lightdash 0.2609.0 before 3.137.0.