PT-2023-2879 · Apache · Apache Superset

Naveen Sunkavally

·

Published

2023-04-24

·

Updated

2025-09-09

·

CVE-2023-27524

CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

**Name of the Vulnerable Software and Affected Versions**

Apache Superset versions up to and including 2.0.1

**Description**

The issue concerns a session validation flaw in Apache Superset, where installations that have not altered the default configured `SECRET KEY` according to installation instructions allow an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for `SECRET KEY` config. The `SECRET KEY` is used to securely sign all session cookies and encrypt sensitive information on the database. Approximately 2,124 servers are potentially affected, with 67% of open internet-facing servers still using the default configuration.

**Recommendations**

For versions up to and including 2.0.1, add a strong `SECRET KEY` to your `superset config.py` file, like `SECRET KEY = <YOUR OWN RANDOM GENERATED SECRET KEY>`. Alternatively, you can set it with the `SUPERSET SECRET KEY` environment variable. As a temporary workaround, consider changing the default `SECRET KEY` to prevent exploitation until a patch is applied or the version is updated. For the best protection, update to version 2.1 or later, which does not allow the server to run with the default `SECRET KEY`.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

BDU:2023-02828
BIT-SUPERSET-2023-27524
CVE-2023-27524
GHSA-5CX2-VQ3H-X52C

Affected Products

Apache Superset