CVEs / CVE-2023-27524
CVE-2023-27524: Apache Superset Insecure Default Initialization of Resource Vulnerability
- Known exploited in the CISA KEV catalog since 8 Jan 2024
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 98.1% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-27524
Summary
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Superset | up to and including 2.0.1 | — |
| Product | Affected | Fixed in |
|---|---|---|
| apache-superset (PyPI) | before 2.1.0 | 2.1.0 |
Package versions from GHSA-5cx2-vq3h-x52c.
Exploitation
| In CISA KEV since | 8 Jan 2024 |
|---|---|
| Due date for US federal agencies | 29 Jan 2024 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-1188 |
References
- CVE-2023-27524 on NVD
- CVE-2023-27524 in the CISA KEV catalog
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk (cited by CISA)
- CVE-2023-27524 on OSV
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk Mailing List, Vendor Advisory
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html Exploit, Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://www.openwall.com/lists/oss-security/2023/04/24/2 Mailing List
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524 Third Party Advisory, US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.