CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource
Attackers can authenticate and access unauthorized resources if the default SECRET_KEY is not changed, requiring administrators to set a unique key.
- Exploited in the wild
- Since 8 Jan 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27524?
CVE-2023-27524 is a high-severity vulnerability in Apache Superset, published on 24 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like:
SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>
Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Weakness: CWE-1188
Which versions are affected by CVE-2023-27524?
4 open source packages ship an affected version, including apache-superset and superset. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-superset PyPI | All versions | 2.1.0 |
apache-superset PyPI | All versions | 2.1.0 |
apache-superset PyPI | All versions | 2.1.0 |
superset Bitnami | All versions | 2.0.2 |
Products include Apache Superset.
How do I fix CVE-2023-27524?
Upgrade apache-superset to 2.1.0 or later. US federal agencies must fix it by 29 Jan 2024.
Is CVE-2023-27524 being exploited?
Yes. Attackers have exploited CVE-2023-27524 in the wild since at least 8 Jan 2024.
Public exploit code: 2 Metasploit modules, 1 Exploit-DB entry, 1 Nuclei template and 16 proofs of concept on GitHub.
Other vulnerabilities in Apache Superset
- CVE-2022-27479 SQL injection vulnerability in chart data API
- CVE-2018-8021 Deserialization of Untrusted Data in superset
- CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title
- CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
- CVE-2021-41971 Possible SQL Injection when template processing is enabled
Sources
Also known as BIT-superset-2023-27524, GHSA-5cx2-vq3h-x52c, PYSEC-2026-1161.