Apache · Superset
Apache Superset, versions up to and including 2.0.1, ships with an insecure default initialization in which the SECRET_KEY is left at its default value when installers do not follow the setup instructions to configure a unique key. An attacker with network access, requiring no privileges or user interaction, can exploit this on installations still using the default SECRET_KEY to forge session validation and gain unauthorized access to resources, whereas administrators who have changed the default are not affected.
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
First seen exploited 9 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability is exploited by a remote attacker who forges a session cookie leveraging user_id or _user_id set to 1 in order to log in as an administrator. A successful exploitation could allow the adversary to gain authenticated access and gain access to unauthorized resources.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: apache-superset.
Upgrade to 2.1.1 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2021-27907, CVE-2021-28125, +2).
pip install "apache-superset>=2.1.1"First fixed in 2.1.0 for CVE-2023-27524.
| If you run | Upgrade to |
|---|---|
| All versions before 2.1.0 | 2.1.1first fix for this CVE: 2.1.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.