threat-modeling.md

Threat Model Analysis for getredash/redash

Threat: Data Source Credential Theft via API

• Threat: Data Source Credential Theft via API

  • Description: An attacker with API access (either through a compromised API key or a vulnerability in the API endpoint) could retrieve the stored credentials for connected data sources. The attacker could use the /api/data_sources endpoint (or similar) to list all data sources and their configurations, potentially including sensitive credentials. This directly exploits Redash's API for managing data sources.
  • Impact: Complete compromise of connected data sources, leading to data breaches, data manipulation, and potential system compromise.
  • Affected Component: Redash API (/api/data_sources and related endpoints), Data Source Management module (redash.models.DataSource, redash.handlers.data_sources).
  • Risk Severity: Critical
  • Mitigation Strategies:
    • API Key Management: Implement strict API key management, including regular rotation, limited permissions per key, and monitoring of API key usage.
    • Input Validation & Authorization: Ensure robust input validation and authorization checks on all API endpoints, particularly those related to data source management. Verify that the requesting user/API key has the necessary permissions.
    • Secrets Management: Store data source credentials only in a secure secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager). Redash should retrieve credentials from the secrets manager at runtime, never storing them directly in its database or configuration files.
    • Audit Logging: Log all API requests, including successful and failed attempts, to access data source information.

Threat: SQL Injection via Query Parameter Manipulation

• Threat: SQL Injection via Query Parameter Manipulation

  • Description: An attacker with the ability to create or modify queries within Redash attempts to inject malicious SQL code through improperly handled query parameters. Even if Redash intends to use parameterized queries, a flaw in Redash's query execution logic or a misconfiguration in Redash's data source connector could allow injection. The attacker might try to manipulate parameters passed to the redash.tasks.queries.execute_query function. This is a direct threat to Redash's query handling.
  • Impact: Data breaches, data modification, potential execution of arbitrary commands on the database server (depending on the database and its configuration).
  • Affected Component: Query Execution Engine (redash.tasks.queries.execute_query), Data Source Connectors (e.g., redash.query_runner.pg, redash.query_runner.mysql), Query Result Handling.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Strict Parameterized Query Enforcement: Enforce the use of parameterized queries at all levels: within Redash's query editor, in the query execution engine, and in the data source connectors. Disable any features that allow raw SQL string construction with user-supplied input.
    • Input Validation (Secondary Defense): Implement strict input validation on all user-supplied parameters, even if parameterized queries are used. This provides a defense-in-depth approach.
    • Data Source Connector Security: Ensure that all Redash data source connectors are up-to-date and configured securely to prevent SQL injection. Regularly review connector code for potential vulnerabilities.
    • Web Application Firewall (WAF): Deploy a WAF with rules to detect and block SQL injection attempts. While a WAF is a general defense, it's relevant here as it can protect Redash's exposed interface.

Threat: Privilege Escalation via User Management Flaws

• Threat: Privilege Escalation via User Management Flaws

  • Description: An attacker exploits a vulnerability in Redash's user management system to gain elevated privileges (e.g., becoming an administrator). This could involve manipulating user roles, creating new users with excessive permissions, or exploiting flaws in Redash's authentication or authorization logic (redash.handlers.users, redash.models.User, redash.authentication). This is a direct attack on Redash's user management functionality.
  • Impact: Complete compromise of the Redash instance, allowing the attacker to access all data sources, modify configurations, and potentially compromise connected systems.
  • Affected Component: User Management Module (redash.handlers.users, redash.models.User), Authentication and Authorization Logic (redash.authentication), API Endpoints related to user management.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Robust Input Validation: Implement strict input validation on all user management forms and API endpoints to prevent attackers from manipulating user data or roles.
    • Secure Authentication: Enforce strong passwords, multi-factor authentication (MFA), and secure session management.
    • Role-Based Access Control (RBAC): Implement a well-defined RBAC system to ensure that users have only the minimum necessary permissions.
    • Regular Security Audits: Conduct regular security audits of the user management system to identify and address potential vulnerabilities.
    • Limit Self-Registration: If self-registration is enabled, ensure that newly registered users have minimal privileges by default.

Threat: Data Exfiltration via Alerting Mechanism

• Threat: Data Exfiltration via Alerting Mechanism

  • Description: An attacker configures malicious alerts within Redash to exfiltrate data. They could set up alerts that trigger on specific conditions and send the results to an external endpoint controlled by the attacker (e.g., a webhook). This abuses the redash.tasks.alerts.check_alerts and related functions within Redash.
  • Impact: Sensitive data is sent to an attacker-controlled location, leading to a data breach.
  • Affected Component: Alerting System (redash.tasks.alerts, redash.models.Alert, redash.destinations), specifically webhook and email destinations.
  • Risk Severity: High
  • Mitigation Strategies:
    • Alert Destination Whitelisting: Restrict the allowed destinations for alerts (e.g., only allow webhooks to specific, trusted domains). This is a configuration setting within Redash.
    • Alert Content Review: Implement a process for reviewing and approving new alert configurations, especially those that send data to external destinations.
    • Alert Auditing: Log all alert activity, including the alert configuration, trigger conditions, and destination.
    • Limit Alert Frequency: Restrict the frequency with which alerts can be triggered to prevent attackers from exfiltrating large amounts of data quickly.

Threat: Unauthorized Dashboard Access via Shared Link Manipulation

• Threat: Unauthorized Dashboard Access via Shared Link Manipulation

  • Description: An attacker gains access to a shared dashboard link (either through guessing, social engineering, or a compromised account) and views data they are not authorized to see. The attacker might try to modify the URL of a shared dashboard (e.g., changing the dashboard ID) to access other dashboards. This exploits weaknesses in Redash's sharing mechanism (redash.handlers.dashboards.show, redash.models.Dashboard).
  • Impact: Unauthorized data disclosure, potentially leading to privacy violations or competitive disadvantage.
  • Affected Component: Dashboard Sharing Mechanism (redash.handlers.dashboards.show, redash.models.Dashboard), Access Control Logic.
  • Risk Severity: High
  • Mitigation Strategies:
    • Strong Authentication for Shared Links: Require users to authenticate before accessing shared dashboards, even if they have the link. Avoid relying solely on "secret" URLs for security.
    • Access Control Lists (ACLs): Implement fine-grained ACLs to control which users or groups can access specific dashboards.
    • Link Expiration: Configure shared links to expire after a certain period of time or a certain number of views.
    • Audit Logging: Log all access to shared dashboards, including the user (if authenticated), IP address, and timestamp.
    • Disable Public Sharing: If possible, disable the ability to create publicly accessible dashboards entirely. This is a configuration option within Redash.