PT-2023-5054 · Apache · Apache Superset

Naveen Sunkavally · Published 2023-07-26 · Updated 2025-02-05 · CVE-2023-39265

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0

Description The issue is related to the use of alternative driver names when importing a database, which could allow a remote attacker to create arbitrary files and gain unauthorized access to protected information by connecting to SQLite databases. This could result in unexpected file creation on Superset web servers. If Apache Superset is using a SQLite database for its metadata, it could lead to more severe vulnerabilities related to confidentiality and integrity.

Recommendations For Apache Superset versions up to and including 2.1.0, update to a version later than 2.1.0 to resolve the issue. As a temporary workaround, consider restricting the use of alternative driver names like sqlite+pysqlite to minimize the risk of exploitation. Avoid using database imports that could lead to incorrect registration of SQLite database connections until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-05600

BIT-SUPERSET-2023-39265

CVE-2023-39265

GHSA-FM4Q-J8G4-C9J4

Affected Products

Apache Superset

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb · Exploit
• https://bdu.fstec.ru/vul/2023-05600 · Security Note
• https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfy · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm4q-j8g4-c9j4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39265 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2023-39265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39265 · Security Note
• https://github.com/apache/superset · Note
• https://t.me/cybersecuritytechnologies/8984 · Telegram Post
• https://twitter.com/Swati_THN/status/1699740368646914081 · Twitter Post
• https://twitter.com/unix_root/status/1699740567633097133 · Twitter Post
• https://twitter.com/CVEnew/status/1699416737614344216 · Twitter Post
• https://twitter.com/0xedeon/status/1699761792900366502 · Twitter Post
• http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html · Note
• https://t.me/thehackernews/3838 · Telegram Post