PT-2023-2879 · Apache · Apache Superset
Naveen Sunkavally
·
Publicado
2023-04-24
·
Atualizado
2025-09-09
·
CVE-2023-27524
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Superset versions up to and including 2.0.1
Description
The issue concerns a session validation flaw in Apache Superset, where installations that have not altered the default configured
SECRET KEY according to installation instructions allow an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET KEY config. The SECRET KEY is used to securely sign all session cookies and encrypt sensitive information on the database. Approximately 2,124 servers are potentially affected, with 67% of open internet-facing servers still using the default configuration.Recommendations
For versions up to and including 2.0.1, add a strong
SECRET KEY to your superset config.py file, like SECRET KEY = <YOUR OWN RANDOM GENERATED SECRET KEY>. Alternatively, you can set it with the SUPERSET SECRET KEY environment variable. As a temporary workaround, consider changing the default SECRET KEY to prevent exploitation until a patch is applied or the version is updated. For the best protection, update to version 2.1 or later, which does not allow the server to run with the default SECRET KEY.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Superset