CVE-2021-44451: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed…

PriorityP346medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EXPLOIT

EPSS

7.86%

94.7th percentile

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	superset	<= 1.3.2	—
apache_software_foundation	apache_superset	Apache Superset – 1.3.2	—

Detection & IOCsextracted from sources · hover to see the quote

urlGET /login/ HTTP/1.1↗

urlPOST /login/ HTTP/1.1↗

urlGET /dashboard/list/ HTTP/1.1↗

path/login/↗

path/dashboard/list/↗

→Detect successful Apache Superset default-credential login by checking for 'session' cookie in POST /login/ response header ↗
→Confirm authenticated access to Apache Superset dashboard by checking for 'DashboardFilterStateRestApi' string in /dashboard/list/ response body ↗
→Identify Apache Superset instances via Shodan favicon hash 1582430156 or HTML keyword 'apache superset' ↗
→Identify Apache Superset instances via FOFA body keyword 'apache superset' or icon_hash 1582430156 ↗
→Extract CSRF token from login page using regex on hidden input field before attempting credential submission ↗
→Default credentials used in exploitation attempt are username 'admin' and password 'admin' ↗

·Vulnerability affects Apache Superset versions up to and including 1.3.2 only; version 1.4.0 and higher are not affected ↗
·Exploitation requires the attacker to already be an authenticated user; this is not an unauthenticated attack ↗
·The attack flow requires a 3-step HTTP sequence: GET /login/ to fetch CSRF token, POST /login/ with credentials, then GET /dashboard/list/ to confirm access ↗

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.