{"id":"GHSA-q6j3-c4wc-63vw","aliases":[],"url":"https://o3.security/vulnerability/GHSA-q6j3-c4wc-63vw","summary":"CSRF tokens leaked in URL by canned query form","details":"### Impact\n\nThe HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698).\n\nThis means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhood_search submitting the form took me to:\n\nhttps://latest.datasette.io/fixtures/neighborhood_search?text=down&csrftoken=CSRFTOKEN-HERE\n\nThis token could potentially leak to an attacker if the resulting page has a link to an external site on it and the user clicks the link, since the token would be exposed in the referral logs.\n\n### Patches\n\nA fix for this issue has been released in Datasette 0.46.\n\n### Workarounds\n\nYou can fix this issue in a Datasette instance without upgrading by copying the [0.46 query.html template](https://raw.githubusercontent.com/simonw/datasette/0.46/datasette/templates/query.html) into a custom `templates/` directory and running Datasette with the `--template-dir=templates/` option.\n\n### References\n\nIssue 918 discusses this in details: https://github.com/simonw/datasette/issues/918\n\n### For more information\n\nContact swillison at gmail with any questions.","published":"2020-08-11T14:54:40Z","modified":"2024-12-02T05:44:09.099874Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"datasette","fixedVersion":"0.46"}],"fix":{"url":"https://github.com/simonw/datasette/commit/7f10f0f7664d474c1be82bf668829e3b736a3d2b","label":"simonw/datasette@7f10f0f"},"references":[{"type":"WEB","url":"https://github.com/simonw/datasette/security/advisories/GHSA-q6j3-c4wc-63vw"},{"type":"WEB","url":"https://github.com/simonw/datasette/issues/918"},{"type":"WEB","url":"https://github.com/simonw/datasette/commit/7f10f0f7664d474c1be82bf668829e3b736a3d2b"},{"type":"PACKAGE","url":"https://github.com/simonw/datasette"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-PYTHON-DATASETTE-598229"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-02T05:44:09.099874Z"}}