CVE-2021-23404
📋 TL;DR
This vulnerability affects all versions of the sqlite-web package, allowing attackers to perform unauthorized sensitive actions through Cross-Site Request Forgery (CSRF). Attackers can trick authenticated users into executing SQL operations without their knowledge by exploiting missing CSRF protection in the SQL dashboard.
💻 Affected Systems
- sqlite-web
📦 What is this software?
Sqlite Web by Sqlite Web Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data deletion, modification, or exfiltration through unauthorized SQL execution.
Likely Case
Unauthorized data manipulation or extraction through crafted SQL queries executed via CSRF.
If Mitigated
No impact if proper CSRF tokens are implemented and validated for all sensitive actions.
🎯 Exploit Status
Exploitation requires the victim to be authenticated to sqlite-web and visit a malicious website. CSRF attacks are well-understood and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/coleifer/sqlite-web/security/advisories
Restart Required: Yes
Instructions:
1. Check for updated version of sqlite-web package. 2. If no patch available, implement CSRF protection manually. 3. Restart the sqlite-web service after changes.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF token validation to all POST requests in the SQL dashboard endpoints.
Modify sqlite-web source code to include CSRF tokens in forms and validate them server-side
Use SameSite Cookies
allConfigure session cookies with SameSite=Strict attribute to prevent CSRF from external sites.
Set session cookie with SameSite=Strict attribute in web server configuration
🧯 If You Can't Patch
- Restrict access to sqlite-web to trusted networks only using firewall rules
- Implement a reverse proxy with additional CSRF protection or require re-authentication for sensitive actions
🔍 How to Verify
Check if Vulnerable:
Check if sqlite-web is installed and if CSRF tokens are missing from SQL dashboard forms and endpoints.Check Version:
pip show sqlite-web | grep VersionVerify Fix Applied:
Verify that all POST requests to SQL dashboard endpoints require and validate CSRF tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple SQL operations from same user in rapid succession
- SQL queries with unusual patterns or from unexpected sources
Network Indicators:
- HTTP POST requests to /sql/ endpoints without Referer header validation
- Requests with missing or invalid CSRF tokens
SIEM Query:
source="sqlite-web" AND (method="POST" AND uri="/sql/*") | stats count by src_ip, user🔗 References
- https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1
- https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324
- https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1
- https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324
