// For flags

CVE-2023-39265

Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Apache Superset permitiría que las conexiones de bases de datos SQLite se registraran incorrectamente cuando un atacante utiliza nombres de controladores alternativos como sqlite+pysqlite o utiliza importaciones de bases de datos. Esto podría permitir la creación inesperada de archivos en los servidores web Superset. Además, si Apache Superset utiliza una base de datos SQLite para sus metadatos (no recomendado para uso en producción), podría generar vulnerabilidades más graves relacionadas con la confidencialidad y la integridad. Esta vulnerabilidad existe en las versiones de Apache Superset hasta la 2.1.0 incluida.

Apache Superset versions 2.0.0 and below utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user. From there the Superset database is mounted, and credentials are pulled. A dashboard is then created. Lastly a pickled python payload can be set for that dashboard within Superset's database which will trigger the remote code execution. An attempt to clean up ALL of the dashboard key values and reset them to their previous values happens during the cleanup phase.

*Credits: Naveen Sunkavally (Horizon3.ai)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-07-26 CVE Reserved
  • 2023-09-06 CVE Published
  • 2024-09-27 CVE Updated
  • 2024-10-08 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Superset
Search vendor "Apache" for product "Superset"
<= 2.1.0
Search vendor "Apache" for product "Superset" and version " <= 2.1.0"
-
Affected