Apache Superset up to 2.0.1 SECRET_KEY insecure default initialization of resource

Summaryinfo

A vulnerability, which was classified as critical, was found in Apache Superset up to 2.0.1. This affects an unknown part. Such manipulation of the argument SECRET_KEY leads to insecure default initialization of resource. This vulnerability is documented as CVE-2023-27524. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache Superset up to 2.0.1. Affected by this issue is some unknown functionality. The manipulation of the argument SECRET_KEY with an unknown input leads to a insecure default initialization of resource vulnerability. Using CWE to declare the problem leads to CWE-1188. The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

The weakness was released 04/24/2023. The advisory is available at lists.apache.org. This vulnerability is handled as CVE-2023-27524 since 03/02/2023. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as attacked. As 0-day the estimated underground price was around $5k-$25k. This issue was added on 01/08/2024 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 01/29/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51447). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Apache

Name

• Superset

Version

• 2.0.0
• 2.0.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion