Executive brief
Apache Superset is a business intelligence and data visualization platform that allows users to query and explore databases via a SQL Lab interface. A flaw in authorization checks permits authenticated SQL Lab users to modify sensitive database tables—including user authentication and role data—by bypassing intended restrictions through specially crafted SQL syntax. An attacker could escalate privileges to administrator or potentially achieve remote code execution by tampering with authentication records or configuration data.
Technical details
The vulnerability is an improper authorization check (CWE-863) in Superset's SQL Lab query validation. On deployments where the default examples database connection allows access to both the examples schema and Superset's metadata database, an authenticated attacker can bypass read-only protections on tables like ab_user and ab_user_role by embedding INSERT, UPDATE, or DELETE operations within Common Table Expressions (WITH ... AS ... RETURNING syntax). This allows direct modification of user records, role assignments, and potentially the key_value configuration table. An attacker with SQL Lab access and read access to these metadata tables can insert new admin users or reassign their own role to administrator. Superset versions before 2.1.2 are affected; the patch reinforces SQL statement filtering to detect modification keywords even within CTE constructs.
Affected products
- Apache Superset before 2.1.2
Timeline
- 2023-11-27: disclosed: Advisory published
- 2023-11-27: patched: Version 2.1.2 released with fix