Apache Superset improper authorization in SQL Lab

Severity: low · CVSS 3.1 · Published 2023-11-27

Apache Superset is a business intelligence and data visualization platform that allows users to query and explore databases via a SQL Lab interface. A flaw in authorization checks permits authenticated SQL Lab users to modify sensitive database tables—including user authentication and role data—by bypassing intended restrictions through specially crafted SQL syntax. An attacker could escalate privileges to administrator or potentially achieve remote code execution by tampering with authentication records or configuration data.

Technologies: Apache Superset, apache-superset (PyPI). Vendors: Apache, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 27 November 2023.
Which products and versions are affected?
Apache Superset before 2.1.2; apache-superset (PyPI) ECOSYSTEM:introduced=0,fixed=2.1.2.
Is there a fix for This vulnerability?
Yes. apache-superset (PyPI): upgrade to 2.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked from the adjacent network, in a web application.
Am I affected?
Check whether you run Apache Superset or apache-superset (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apache-superset (PyPI): upgrade to 2.1.2 or later
    pip install "apache-superset>=2.1.2"

Technical details

The vulnerability is an improper authorization check (CWE-863) in Superset's SQL Lab query validation. On deployments where the default examples database connection allows access to both the examples schema and Superset's metadata database, an authenticated attacker can bypass read-only protections on tables like ab_user and ab_user_role by embedding INSERT, UPDATE, or DELETE operations within Common Table Expressions (WITH ... AS ... RETURNING syntax). This allows direct modification of user records, role assignments, and potentially the key_value configuration table. An attacker with SQL Lab access and read access to these metadata tables can insert new admin users or reassign their own role to administrator. Superset versions before 2.1.2 are affected; the patch reinforces SQL statement filtering to detect modification keywords even within CTE constructs.

Affected products

  • Apache Superset before 2.1.2

Timeline

  • 2023-11-27: disclosed: Advisory published
  • 2023-11-27: patched: Version 2.1.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.