Multiple vulnerabilities in Apache Superset



| Updated: 2024-06-21
Risk Medium
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2023-32672
CVE-2023-37941
CVE-2023-39265
CVE-2023-39264
CVE-2023-27526
CVE-2023-27523
CVE-2023-36388
CVE-2023-36387
CWE-ID CWE-284
CWE-94
CWE-200
CWE-862
CWE-918
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
 Apache Superset
Web applications / Other software

Vendor Apache Foundation

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU85973

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-32672

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and query database tables they do not have access to.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3 External links

http://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU85972

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-37941

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing metadata. A remote user with write access to the Apache Superset metadata database can inject a specially crafted Python code and execute it on Superset's web backend.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 1.5.0 - 2.1.0

CPE2.3 External links

http://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h
http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Improper access control

EUVDB-ID: #VU85971

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39265

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when using alternative driver names or database imports. A remote user can bypass implemented security restrictions and gain unauthorized access to the application, or create files on on Superset webservers. This can result in remote code execution.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfy
http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU85970

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39264

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the REST API endpoints. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU85969

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27526

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and create resources using the import charts feature.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/ndww89yl2jd98lvn23n9cj722lfdg8dv


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Missing authorization

EUVDB-ID: #VU85968

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27523

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to missing authorization check on Jinja templated queries. A remote user can bypass implemented security restrictions and issue queries to database tables they have no access to.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU85967

Risk: Medium

CVSSv3.1: 4.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-36388

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote Gamma user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU85966

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-36387

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote Gamma user can bypass implemented security restrictions and test database connections via REST API.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Superset: 2.0.0 - 2.1.0

CPE2.3
External links

http://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3
http://github.com/apache/superset/pull/24185


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###