PT-2024-4329 · Apache · Apache Superset

Mal + 1 · Published 2024-06-20 · Updated 2025-02-05 · CVE-2024-34693

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.1.3 Apache Superset version 4.0.0

Description The issue is related to improper input validation in Apache Superset, allowing an authenticated attacker to create a MariaDB connection with local infile enabled. If both the MariaDB server and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that can read files from the server and insert their content into a MariaDB database table.

Recommendations For Apache Superset versions prior to 3.1.3, upgrade to version 3.1.3 to fix the issue. For Apache Superset version 4.0.0, upgrade to version 4.0.1 to fix the issue. As a temporary workaround, consider disabling the local infile option in the MariaDB connection to minimize the risk of exploitation. Restrict access to the MariaDB database table to prevent unauthorized data insertion. Avoid using the local mysql client on the web server to connect to the MariaDB server until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-04817

BIT-SUPERSET-2024-34693

CVE-2024-34693

GHSA-HCR7-CQWC-Q5GQ

Affected Products

Apache Superset

References · 15

• 🔥 https://github.com/mbadanoiu/CVE-2024-34693 · Exploit
• https://osv.dev/vulnerability/CVE-2024-34693 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcr7-cqwc-q5gq · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04817 · Security Note
• https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34693 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2024-34693 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/pentestingnews/49617 · Telegram Post
• https://twitter.com/oss_security/status/1803774032585666827 · Twitter Post
• https://openwall.com/lists/oss-security/2024/06/20/1 · Note
• https://twitter.com/CVEnew/status/1803718593936511008 · Twitter Post
• https://t.me/securixy_kz/920 · Telegram Post
• http://openwall.com/lists/oss-security/2024/06/20/1 · Note
• https://twitter.com/linuxpatch/status/1803731048531976282 · Twitter Post