PT-2024-9601 · Apache · Apache Superset

Daniel Gaspar + 1 · Published 2024-12-12 · Updated 2025-02-12 · CVE-2024-55633

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.0

Description The issue is related to improper authorization in Apache Superset, specifically affecting Postgres analytic databases. An attacker with access to SQLLab can craft a specially designed SQL DML statement that is incorrectly identified as a read-only query, allowing its execution and potentially enabling unauthorized write access. Non-Postgres analytics database connections and Postgres analytics database connections set with a readonly user are not vulnerable.

Recommendations To resolve the issue, users are recommended to upgrade to version 4.1.0, which fixes the problem. As a temporary workaround, consider restricting access to SQLLab or setting up Postgres analytics database connections with a readonly user to minimize the risk of exploitation.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BDU:2024-11311

BIT-SUPERSET-2024-55633

CVE-2024-55633

GHSA-787V-V9VQ-4RGV

Affected Products

Apache Superset

References · 15

• https://bdu.fstec.ru/vul/2024-11311 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55633 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-787v-v9vq-4rgv · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2024-55633 · Vendor Advisory
• https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55633 · Security Note
• https://github.com/apache/superset · Note
• https://twitter.com/CVEnew/status/1867286501698285646 · Twitter Post
• https://twitter.com/fridaysecurity/status/1867396066880180560 · Twitter Post
• https://t.me/cvedetector/12794 · Telegram Post
• https://t.me/pentestingnews/54230 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1867396931418485007 · Twitter Post
• https://twitter.com/oss_security/status/1867249306333512165 · Twitter Post
• https://t.me/cvenotify/111019 · Telegram Post
• http://openwall.com/lists/oss-security/2024/12/12/1 · Note