Impact

If you do not use Google Login for your instance of Redash, this vulnerability does not affect you.

The current implementation of Google Login (via OAuth) incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a CSRF token, not a static and easily predicted value.

Our thanks to the reporter of this vulnerability, who wished to remain anonymous.

Patches

The current master and release/10.x.x branches address this by replacing Flask-Oauthlib with Authlib which automatically provides and validates a CSRF token for the state variable. The new implementation stores the next URL on the user session object.

Affected users should upgrade to V10.1. For Docker installations, you can upgrade to Docker Tag redash/redash:10.1.0.b50633.

Workarounds

Disabling Google Login will mitigate the vulnerability.

1. First you should re-enable password login for your instance.
2. Then disable Google login.
3. After this, each user will need to reset their password from the log-in screen.

References

Redash Authentication Guide
Google's Official guidance on the state token

For more information

If you have any questions or comments about this advisory:

• Open an issue in getredash/redash if you believe further development is needed.
• Start a thread in the forum.