Insecure default initialization of resource in Apache Superset - CVE-2023-27524
Published: January 9, 2024 / Updated: December 19, 2024
Vulnerability identifier: #VU85166
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-27524
CWE-ID: CWE-1188
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to the application does not alter the default configured SECRET_KEY by itself. A remote attacker can authenticate and access unauthorized resources if the software installation was not performed according to vendor's instructions.
Affected software
Apache Superset
How to mitigate CVE-2023-27524
Install updates from vendor's website.
Apache Superset - update to 2.1.0
Links to Public Exploits and PoC-codes
- Exploit #11012 - CVE-2023-27524 (Apache Superset - Authentication Bypass) (December 19, 2024)
- Exploit #10888 - CVE-2023-27524 (Apache Superset Auth Bypass (CVE-2023-27524)) (November 22, 2024)
- Exploit #10718 - Apache Superset 2.0.0 - Authentication Bypass (October 25, 2024)
- Exploit #10521 - CVE-2023-27524 (Apache Superset Auth Bypass Vulnerability CVE-2023-27524.) (September 20, 2024)
- Exploit #10390 - CVE-2023-27524 (Perform With Apache-SuperSet Leaked Token [CSRF]) (August 16, 2024)
- Exploit #9934 - CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE () (June 7, 2024)
- Exploit #9601 - CVE-2023-27524 (Basic PoC for CVE-2023-27524: Insecure Default Configuration in Apache Superset) (March 13, 2024)
- Exploit #9492 - Apache Superset Signed Cookie RCE (January 9, 2024)
- Exploit #9493 - Apache Superset Signed Cookie Priv Esc (January 9, 2024)
External References
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk
- http://www.openwall.com/lists/oss-security/2023/04/24/2
- http://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
- http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html