Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. As of time of publication, the master and release/10.x.x branches address this by applying the Advocate library for making http requests instead of the requests library directly. Users should upgrade to version 10.0.1 to receive this patch. There are a few workarounds for mitigating the vulnerability without upgrading. One can disable the vulnerable data sources entirely, by adding the following env variable to one's configuration, making them unavailable inside the webapp. One can switch any data source of certain types (viewable in the GitHub Security Advisory) to be View Only for all groups on the Settings > Groups > Data Sources screen. For users unable to update an admin may modify Redash's configuration through environment variables to mitigate this issue. Depending on the version of Redash, an admin may also need to run a CLI command to re-encrypt some fields in the database. The master and release/10.x.x branches as of time of publication have removed the default value for REDASHCOOKIESECRET. All future releases will also require this to be set explicitly. For existing installations, one will need to ensure that explicit values are set for the REDASHCOOKIESECRET and REDASHSECRETKEY variables.

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the getredash/setup repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the REDASHCOOKIESECRET environment variable. If it is c292a0a3aa32397cdb050e233733900f, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.

Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding headers, selecting any HTTP verb, etc.

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery (CSRF) token, not a static and easily predicted value. This vulnerability does not affect users who do not use Google Login for their instance of Redash. A patch in the master and release/10.x.x branches addresses this by replacing Flask-Oauthlib with Authlib which automatically provides and validates a CSRF token for the state variable. The new implementation stores the next URL on the user session object. As a workaround, one may disable Google Login to mitigate the vulnerability.

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.

Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization.

A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function runquery of the file /queryrunner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards."

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults() to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with executequery permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASHENFORCEPRIVATEIPBLOCK was enabled. This issue is fixed in version 26.9.0.

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryN{key=value} parameters and passed attacker-controlled values to replacequeryparameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the issafe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect() path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASHCOOKIESECRET or REDASHSECRETKEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.