Public Dashboard Action Prefill Leaks Values for Unrelated Dashcards

Summary

An unauthenticated user who knows any valid public dashboard UUID can retrieve prefill values for implicit action dashcards that belong to other, unrelated dashboards. The route treats the UUID and the dashcard ID as independent inputs, so possessing a single public dashboard link is sufficient to read action prefill data for any dashcard whose ID the caller can supply or enumerate.

Details

The public action prefill route: GET /api/public/dashboard/:uuid/dashcard/:dashcard-id/execute validates that the supplied :uuid corresponds to a public dashboard, but then resolves the action using only the attacker-controlled :dashcard-id path parameter. The route doesn’t verify that the dashcard belongs to the dashboard identified by :uuid.

Any instance with public sharing enabled and at least one published public dashboard exposes prefill values to anonymous callers who can guess or enumerate numeric dashcard IDs. These values include default parameter values for any implicit action dashcard in the instance.

The equivalent POST execute path binds the dashboard and dashcard together and correctly rejects cross-dashboard requests; the GET prefill path does not.

Patches

The fix is available in the following versions and above:

• 1.58.13, 0.58.13
• 1.59.7, 0.59.7

Credit

Alec Chappell (@alecclyde)