Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
15 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A vulnerability in datastoresearchsql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 Workarounds Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default. More information As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in your DataStore and the likelihood of abuse of your site, you may choose to disable this action function or restrict its use with a IAuthFunctions plugin. Credits Reported by Arvin Shivram of Brutecat Security
Recommended action: Upgrade to 2.11.5 or 2.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability in datastoresearchsql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 Workarounds Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default. More information As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a IAuthFunctions plugin. Credits Reported by Arvin Shivram of Brutecat Security
Recommended action: Upgrade to 2.11.5 or 2.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Views can be marked as exempt from CSRF protection Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flaskapp middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This could be leveraged with XSS to perform actions using other user's credentials. References Vulnerability report by @Shirshaw64p (original reporter)
Recommended action: Upgrade to 2.11.5 or 2.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. Patches The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5
Recommended action: Upgrade to 2.11.5 or 2.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. Patches This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4 References https://en.wikipedia.org/wiki/Sessionfixation
Recommended action: Upgrade to 2.11.4 or 2.10.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The helpers.markdownextract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. Patches This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
Recommended action: Upgrade to 2.11.4 or 2.10.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. Patches This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2 Workarounds On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the ckan.upload.user.mimetypes / ckan.upload.user.types and ckan.upload.group.mimetypes / ckan.upload.group.types config options. To entirely disable file uploads you can use:
Recommended action: Upgrade to 2.11.2 or 2.10.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Patches and Workarounds Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.downloadproxy config option. Implement custom firewall rules…
Recommended action: Upgrade to 2.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Impact Sites running CKAN = 2.7.0 with the datatablesview plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. Patches This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0 Workarounds Prevent importing of tabular files to the DataStore via DataPusher, XLoader,etc, at least those published from untrusted sources.
Recommended action: Upgrade to 2.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to packagesearch calls as part of the returned error message Patches This has been patched in CKAN 2.10.5 and 2.11.0
Recommended action: Upgrade to 2.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. Patches This has been fixed in the CKAN 2.9.11 and 2.10.4 versions Workarounds Override the /user/reset endpoint to filter the id parameter in order to exclude newlines
Recommended action: Upgrade to 2.10.4 or 2.9.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create or edit datasets. Patches This vulnerability has been patched in CKAN 2.10.3 and 2.9.10
Recommended action: Upgrade to 2.10.3 or 2.9.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Specific vulnerabilities: * Arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. * Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. * Potential DOS due to lack of a length check on the resource id. * Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. * Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. Impact A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's…
Recommended action: Upgrade to 2.10.1 or 2.9.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
Recommended action: Upgrade to 2.9.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
Recommended action: Upgrade to 2.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.