Skip to content
Log inStart free trial

GHSA-f678-j579-4xf5 BIT-superset-2023-40610 CVE-2023-40610 PYSEC-2026-1173

Apache Superset - Elevation of Privilege

High PyPI
Severity
7.3 / 10
High · CVSS 3.1
Exploit chance (EPSS)
1.33%
Chance of exploitation in the next 30 days. Higher than 71.17% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-863 Incorrect Authorization
Fix
2.1.2
Upgrade apache-superset to this version or later

Description

Overview

An attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.

Details

On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability).

Proof of Concept

Some tables are supposed to accept only SELECT requests from the SQL tab.

  • Attempt to create a new user injected_admin into the ab_user table: PoC_1

But this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query. INSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax: WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘injected_admin@gmail.com’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a; PoC_2

  • injected_admin added to the ab_user table: PoC_3

This method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables ab_user_role can escalate his privilege to become administrator.

  • Locating the ID of the user ‘Auditeur B’, who has no rights and is not an admin. The request is done being ‘Auditeur B’: PoC_4
  • Locating the rows that keep the role of the user ‘Auditeur B’. The row 36 stores the value 3, indicating the role ‘Alpha’ for ‘Auditeur B’: PoC_5
  • Modification of the row 36 with an UPDATE request embedded in a WITH request: PoC_6
  • ‘Auditeur B’ role has been changed to Admin: PoC_7

This technique can also be used to inject or modify values of the table key_value, which can potentially lead to a Remote Code Execution (cf. ...).

Solution

Orange recommendation

To fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests.

Security patch

Upgrade to Superset version 2.1.2.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-40610 https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot

Credits

LEXFO for Orange Innovation

Orange CERT-CC at Orange group

Timeline

Date reported: July 27, 2023 Date fixed: November 27, 2023

Affected versions

PyPI

PackageVulnerableFixed in
apache-superset
< 2.1.2
2.1.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

apache-superset PyPI → 2.1.2

pip
pip install --upgrade "apache-superset>=2.1.2"
poetry
poetry add "apache-superset>=2.1.2"
uv
uv add "apache-superset>=2.1.2"

Severity breakdown

CVSS 3.1 7.3

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector
Adjacent
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

How to prevent it
  • Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
  • Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
  • Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
  • Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
  • System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-5cx2-vq3h-x52c
Apache superset missing check for default SECRET_KEY
Critical Known exploited Also affects apache-superset
GHSA-mwf2-qr4v-94h2
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Medium Also affects apache-superset
GHSA-h294-8fxm-m2pj
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium Also affects apache-superset
GHSA-3m2g-v7jf-7fxc
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
Medium Also affects apache-superset
GHSA-gvxg-9hqx-f4rg
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium Also affects apache-superset
GHSA-48m2-v2r8-h23m
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium Also affects apache-superset
GHSA-mhpq-m962-mg92
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium Also affects apache-superset
GHSA-fxgf-3xh6-m2pp
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium Also affects apache-superset
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor