GHSA-p69g-f978-xxv9

Cross-Site Request Forgery (CSRF) in Luigi

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000843

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	luigi	< 2.8.0	2.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000843 advisory
https://github.com/spotify/luigi/pull/1870 web
https://github.com/advisories/GHSA-p69g-f978-xxv9 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2018-11.yaml web
https://github.com/spotify/luigi package
https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67 web
https://groups.google.com/forum/#!topic/luigi-user/ZgfRTpBsVUY web