CVE-2021-1629: 
Tableau Server vulnerability analysis and mitigation

Tableau Server contains a URL validation vulnerability (CVE-2021-1629) discovered in 2020 that affects the email sharing functionality. The vulnerability impacts multiple versions of Tableau Server including 2019.4-2019.4.17, 2020.1-2020.1.13, 2020.2-2020.2.10, 2020.3-2020.3.6, and 2020.4-2020.4.2. The issue was reported to Tableau Security Team on July 29, 2020 and was fixed with patches released on March 23, 2021 (SYSS Advisory).

The vulnerability stems from insufficient server-side validation of user input in the "Share view" function. When sharing views with other users, the server fails to properly validate URLs embedded in emails sent to Tableau Server users. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 Base Score of 6.1 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD Database).

An authenticated attacker can exploit this vulnerability by intercepting a "Share view" request and replacing the shared view's URL with a malicious web page URL. When victims receive the seemingly legitimate email from Tableau Server containing the shared view, clicking on either the image or "Go to View" button directs them to the malicious page. This is particularly dangerous as the email appears completely authentic since it comes from the legitimate Tableau server with official branding (SYSS Advisory).

The vulnerability requires an authenticated Tableau Server account to exploit, though only basic viewer privileges are needed. The attack is limited to targeting users within the same Tableau site. A proof-of-concept demonstrates that attackers can create phishing attacks by directing victims to fake Tableau login pages, potentially harvesting credentials (SYSS Advisory).

The vulnerability has been fixed in Tableau Server versions 2019.4.18, 2020.1.14, 2020.2.11, 2020.3.7, 2020.4.3, and 2021.1. Organizations should upgrade to these or newer versions to protect against this vulnerability (SYSS Advisory).