Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:
SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>
Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | ≤ 2.0.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Apache Superset Signed Cookie RCE
exploit/linux/http/apache_superset_cookie_sig_rce
-
Apache Superset Signed Cookie Priv Esc
auxiliary/gather/apache_superset_cookie_sig_priv_esc
Exploit-DB 1
- Apache Superset 2.0.0 - Authentication Bypass EDB-51447 · webapps · May 23, 2023
GitHub 16 repositories · most starred shown
-
horizon3ai/CVE-2023-27524 ★ 114 · Apr 25, 2023
Basic PoC for CVE-2023-27524: Insecure Default Configuration in Apache Superset
-
jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE ★ 31 · Sep 8, 2023
-
Okaytc/Superset_auth_bypass_check ★ 11 · Apr 27, 2023
Apahce-Superset身份认证绕过漏洞(CVE-2023-27524)检测工具
-
tardc/CVE-2023-27524 ★ 10 · May 8, 2023
Apache Superset Auth Bypass (CVE-2023-27524)
-
Ap0dexMe0/CVE-2023-27524 ★ 3 · May 4, 2023
Perform With Apache-SuperSet Leaked Token [CSRF]
-
ZZ-SOCMAP/CVE-2023-27524 ★ 3 · Apr 27, 2023
Apache Superset Auth Bypass Vulnerability CVE-2023-27524.
-
Cappricio-Securities/CVE-2023-27524 ★ 2 · May 11, 2024
Apache Superset - Authentication Bypass
-
karthi-the-hacker/CVE-2023-27524 ★ 1 · May 11, 2024
Tool for finding CVE-2023-27524 (Apache Superset - Authentication Bypass)
-
MaanVader/CVE-2023-27524-POC ★ 1 · May 4, 2023
A POC for the all new CVE-2023-27524 which allows for authentication bypass and gaining access to the admin dashboard.
-
necroteddy/CVE-2023-27524 ★ 0 · Aug 30, 2023
CVE-2023-27524
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Superset - Authentication Bypass http/cves/2023/CVE-2023-27524.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-superset | < 2.1.0 | 2.1.0 | GHSA-5cx2-vq3h-x52c |
References
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk vendor-advisory
- https://www.openwall.com/lists/oss-security/2023/04/24/2
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html