=====================================================================

                              CERT-Renater

                    Note d'Information No. 2023/VULN296

_____________________________________________________________________

DATE                : 06/09/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Superset versions up to
                                     and including 2.1.0.

=====================================================================
https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp
https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h
https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfy
https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75
https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs
https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3
_____________________________________________________________________

CVE-2023-32672: Apache Superset: SQL parser edge case bypasses data
access authorization
Affected versions:

- Apache Superset through 2.1.0

Description:

An Incorrect authorisation check in SQLLab in Apache Superset versions
up to and including 2.1.0. This vulnerability allows an authenticated
user to query tables that they do not have proper access to within
Superset. The vulnerability can be exploited by leveraging a SQL
parsing vulnerability.


Credit:

Arnaud Pascal @ Vaadata (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-32672

_____________________________________________________________________

CVE-2023-37941: Apache Superset: Metadata db write access can lead
to remote code execution

Affected versions:

- Apache Superset 1.5.0 through 2.1.0

Description:

If an attacker gains write access to the Apache Superset metadata
database, they could persist a specifically crafted Python object
that may lead to remote code execution on Superset's web backend.
This vulnerability impacts Apache Superset versions 1.5.0 up to
and including 2.1.0.


Credit:

Dinis Cruz, cruzdinis@ua.pt (finder)
Naveen Sunkavally (Horizon3.ai) (finder)


References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-37941


_____________________________________________________________________

CVE-2023-39265: Apache Superset: Possible Unauthorized Registration
of SQLite Database Connections

Affected versions:

- Apache Superset through 2.1.0

Description:

Apache Superset would allow for SQLite database connections to be
incorrectly registered when an attacker uses alternative driver
names like sqlite+pysqlite or by using database imports. This could
allow for unexpected file creation on Superset webservers.
Additionally, if Apache Superset is using a SQLite database for its
metadata (not advised for production use) it could result in more
severe vulnerabilities related to confidentiality and integrity.
This vulnerability exists in Apache Superset versions up to and
including 2.1.0.

Credit:

Naveen Sunkavally (Horizon3.ai) (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-39265


_____________________________________________________________________

CVE-2023-39264: Apache Superset: Stack traces enabled by default
Affected versions:

- Apache Superset through 2.1.0

Description:

By default, stack traces for errors were enabled, which resulted
in the exposure of internal traces on REST API endpoints to users.
This vulnerability exists in Apache Superset versions up to and
including 2.1.0.


Credit:

Miguel Segovia Gil (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-39264

_____________________________________________________________________

CVE-2023-36388: Apache Superset: Improper API permission for low
privilege users allows for SSRF

Affected versions:

- Apache Superset through 2.1.0

Description:

Improper REST API permission in Apache Superset up to and including
2.1.0 allows for an authenticated Gamma users to test network
connections, possible SSRF.


Credit:

https://github.com/vin01 (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-36388

_____________________________________________________________________

CVE-2023-36387: Apache Superset: Improper API permission for low
privilege users

Affected versions:

- Apache Superset through 2.1.0

Description:

An improper default REST API permission for Gamma users in Apache
Superset up to and including 2.1.0 allows for an authenticated Gamma
user to test database connections.


Credit:

Miguel Segovia Gil (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-36387




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================