Alert: Apache SuperSet Vulnerabilities Expose Servers to Remote Code Execution Attacks

Patches have been produced to deal with two new security vulnerabilities in Apache SuperSet that could be exploited by an attacker to attain remote code execution on afflicted units.

The update (model 2.1.1) plugs CVE-2023-39265 and CVE-2023-37941, which make it doable to perform nefarious actions at the time a terrible actor is in a position to obtain regulate of Superset’s metadata database.

Outside of these weaknesses, the most up-to-date variation of Superset also remediates a individual poor Relaxation API authorization issue (CVE-2023-36388) that lets for low-privilege customers to carry out server-aspect request forgery (SSRF) attacks.

“Superset by design makes it possible for privileged consumers to join to arbitrary databases and execute arbitrary SQL queries towards people databases employing the effective SQLLab interface,” Horizon3.ai’s Naveen Sunkavally stated in a complex produce-up.

“If Superset can be tricked into connecting to its have metadata databases, an attacker can immediately read or produce application configuration through SQLLab. This sales opportunities to harvesting qualifications and distant code execution.”

CVE-2023-39265 relates to a scenario of URI bypass when connecting to the SQLite databases used for the metastore, enabling an attacker to execute information manipulation instructions.

Also tracked as part of the exact CVE identifier is the lack of validation when importing SQLite database link details from a file, which could be abused to import a maliciously crafted ZIP archive file.

“Superset versions from 1.5 to 2.1. use python’s pickle deal to retail store certain configuration details,” Sunkavally said about CVE-2023-37941.

“An attacker with create access to the metadata database can insert an arbitrary pickle payload into the retail outlet, and then set off deserialization of it, primary to distant code execution.”

Some of the other flaws that have been patched in the latest launch are under –

• An MySQL arbitrary file browse vulnerability that could be exploited to get qualifications to the metadata database
• The abuse of superset load_illustrations command to get the metadata databases URI from the user interface and modify details stored in it
• The use of default qualifications to obtain the metadata database in some installations of Superset
• The leak of database qualifications in plaintext when querying the /api/v1/database API as a privileged person (CVE-2023-30776, mounted in 2.1.)

The disclosure comes a minor more than four months following the firm disclosed a superior-severity flaw in the exact same product or service (CVE-2023-27524, CVSS score: 8.9) that could allow unauthorized attackers to attain admin obtain to the servers and execute arbitrary code.

Future WEBINARWay Way too Vulnerable: Uncovering the State of the Identification Attack Surface

Accomplished MFA? PAM? Company account safety? Discover out how perfectly-geared up your corporation really is from identification threats

Supercharge Your Capabilities

The issue occurs as a end result of applying a default Solution_Key that could be abused by attackers to authenticate and obtain unauthorized means on internet-exposed installations.

Considering that the community disclosure of the flaw in April 2023, Horizon3.ai explained 2076 out of 3842 Superset servers are still employing a default Mystery_Important, with about 72 circumstances employing a trivially guessable Mystery_Critical like superset, SUPERSET_Top secret_Essential, 1234567890, admin, changeme, thisisasecretkey, and your_top secret_critical_right here.

“The user is dependable for setting the Flask Solution_Essential, which invariably potential customers to some customers placing weak keys,” Sunkavally claimed, urging the maintainers to insert assist for automatically generating the critical.

“At the root of several of the vulnerabilities […] is the simple fact that the Superset web interface permits consumers to connect to the metadata database. At the root of quite a few of the vulnerabilities in this write-up is the fact that the Superset web interface permits customers to link to the metadata databases.”

Discovered this short article interesting? Comply with us on Twitter  and LinkedIn to go through more exceptional content material we article.

Some parts of this article are sourced from:
thehackernews.com