Executive brief
Apache Superset is an open-source business intelligence and data visualization platform used to build analytics dashboards. Verbose error messages in the application leak sensitive metadata about underlying analytics databases, allowing an unauthenticated attacker over the network to discover database details without authorization. This information could be used to plan further attacks or gain unauthorized access.
Technical details
The vulnerability is a CWE-209 (Generation of Error Message Containing Sensitive Information) issue where Apache Superset exposes analytics database metadata through overly verbose error messages. The vulnerability affects error handling across all versions before 4.1.0 and is exploitable over the network without authentication or user interaction required. An attacker can trigger errors that reveal database schema, table names, and other sensitive metadata. The fix was released in version 4.1.0, which suppresses metadata disclosure in error messages, particularly for embedded dashboards.
Affected products
- Apache Superset before 4.1.0
Timeline
- 2024-12-09: disclosed