CVE-2021-27907

published 2021-03-05

CVE-2021-27907: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing…

Priority P3 46 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	superset	<= 0.38.0	—
apache_software_foundation	apache_superset	Apache Superset – 0.38.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /superset/save_dash/

url /dashboard/add

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Superset Markdown Component Stored Cross-Site Scripting (CVE-2021-27907) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/superset/save_dash/"; fast_pattern; http.request_body; content:"|22|code|22|"; nocase; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:cve,2021-27907; reference:url,lists.apache.org/thread/r2bwgnq45t3y5mmmzz7gsvgnwt9m14r4; classtype:web-application-attack; sid:2059306; rev:1;)

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Superset Markdown Component Stored Cross-Site Scripting (CVE-2021-27907) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dashboard/add"; fast_pattern; http.request_body; content:"|22|code|22|"; nocase; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:cve,2021-27907; reference:url,lists.apache.org/thread/r2bwgnq45t3y5mmmzz7gsvgnwt9m14r4; classtype:web-application-attack; sid:2059305; rev:1;)

• → Exploit payload is delivered via HTTP POST to either /dashboard/add or /superset/save_dash/ endpoints; inspect request body for the JSON key '"code"' (hex |22|code|22|) containing XSS payloads.
• → The PCRE pattern covers a broad set of XSS event handler keywords to detect in the body: script, onmouse*, onkey*, onerror, onload, onunload, ondragdrop, onblur, onfocus, onclick, ondblclick, onsubmit, onreset, onselect, onchange, style=
• → Stored XSS is triggered automatically on page load for any user visiting the affected dashboard; monitor for anomalous outbound requests originating from dashboard page views as a secondary indicator. ↗

• · The Snort rules require TLS decryption to be effective against HTTPS-protected Superset instances, as indicated by the TLSDecrypt deployment metadata.
• · Affected versions are Apache Superset up to and including 0.38.0; rules may generate false positives or miss payloads on patched or significantly newer versions where endpoint paths have changed. ↗

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79