You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2020/07/29 17:50:59 UTC
[GitHub] [incubator-superset] syazwan0913 opened a new issue #10469: Nessus detected CGI Generic SQL Injection (blind)
syazwan0913 opened a new issue #10469:
URL: https://github.com/apache/incubator-superset/issues/10469
A clear and concise description of what the bug is.
### Expected results
No issue when scanning Apache Superset with Nessus Scanner
### Actual results
Severity of this issue is **High** as reported by Nessus
```
Using the POST HTTP method, Nessus found that :
+ The following resources may be vulnerable to blind SQL injection :
+ The 'csrf_token' parameter of the /login/ CGI :
/login/ [username=&password=&csrf_token=ImE2MWI1OWIwMWFlMTY5ZWM3MzQxM2Ji
OWU4YjYxZjBjOWNhNTg4NWMi.XyD1qA.BEgX-o2rsY4akXtPmPtgh6LG0rQzz&password=&
csrf_token=ImE2MWI1OWIwMWFlMTY5ZWM3MzQxM2JiOWU4YjYxZjBjOWNhNTg4NWMi.XyD1
qA.BEgX-o2rsY4akXtPmPtgh6LG0rQyy]
-------- output --------
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The CSRF tokens do not match.</p>
-------- vs --------
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The CSRF token is invalid.</p>
------------------------
```
#### How to reproduce the bug
1. Have Nessus Scanner installed
2. Scan for vulnerablities for Superset
### Environment
- superset version: `0.34.0`
- python version: `3.6.9`
- flask-appbuilder version: `2.1.9`
### Checklist
Make sure these boxes are checked before submitting your issue - thank you!
- [ ] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [ ] I have reproduced the issue with at least the latest released version of superset.
- [ ] I have checked the issue tracker for the same issue and I haven't found one similar.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] dpgaspar closed issue #10469: Nessus detected CGI Generic SQL Injection (blind)
Posted by GitBox <gi...@apache.org>.
dpgaspar closed issue #10469:
URL: https://github.com/apache/incubator-superset/issues/10469
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] issue-label-bot[bot] commented on issue #10469: Nessus detected CGI Generic SQL Injection (blind)
Posted by GitBox <gi...@apache.org>.
issue-label-bot[bot] commented on issue #10469:
URL: https://github.com/apache/incubator-superset/issues/10469#issuecomment-665741603
Issue-Label Bot is automatically applying the label `#bug` to this issue, with a confidence of 0.88. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: [app homepage](https://github.com/marketplace/issue-label-bot), [dashboard](https://mlbot.net/data/apache/incubator-superset) and [code](https://github.com/hamelsmu/MLapp) for this bot.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] syazwan0913 commented on issue #10469: Nessus detected CGI Generic SQL Injection (blind)
Posted by GitBox <gi...@apache.org>.
syazwan0913 commented on issue #10469:
URL: https://github.com/apache/incubator-superset/issues/10469#issuecomment-666351750
@dpgaspar Yeah sure.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] dpgaspar commented on issue #10469: Nessus detected CGI Generic SQL Injection (blind)
Posted by GitBox <gi...@apache.org>.
dpgaspar commented on issue #10469:
URL: https://github.com/apache/incubator-superset/issues/10469#issuecomment-666350185
Hi @syazwan0913
This issue is already open on flask-appbuilder let's follow it there
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org