PT-2023-5045 · Apache · Apache Superset

Dinis Cruz + 1 · Published 2023-07-11 · Updated 2025-02-05 · CVE-2023-37941

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.0 through 2.1.0

Description The issue is related to a software vulnerability in Apache Superset, specifically a deserialization mechanism flaw. If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata database is an internal component, typically only accessible directly by the system administrator and the Superset process itself, and gaining access to it should be difficult and require significant privileges. Approximately 15,849 results were found, indicating potential exposure.

Recommendations To resolve the issue, users are recommended to upgrade to Apache Superset version 2.1.1 or later. As a temporary workaround, consider restricting access to the Superset metadata database to minimize the risk of exploitation. Additionally, system administrators should ensure that the Superset process itself and the metadata database are properly secured to prevent unauthorized access.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05589

BIT-SUPERSET-2023-37941

CVE-2023-37941

GHSA-FJ4X-M62J-WVWG

Affected Products

Apache Superset

References · 34

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb · Exploit
• https://osv.dev/vulnerability/CVE-2023-37941 · Vendor Advisory
• https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05589 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2023-37941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37941 · Security Note
• https://osv.dev/vulnerability/GHSA-fj4x-m62j-wvwg · Vendor Advisory
• https://github.com/apache/superset · Note
• https://twitter.com/zoomeye_team/status/1700094070356603216 · Twitter Post
• https://t.me/cybersecuritytechnologies/8984 · Telegram Post
• https://twitter.com/moong1ider/status/1699917919734677750 · Twitter Post
• https://twitter.com/Swati_THN/status/1699740368646914081 · Twitter Post
• https://twitter.com/unix_root/status/1699740567633097133 · Twitter Post
• https://twitter.com/0xedeon/status/1699761792900366502 · Twitter Post
• http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html · Note