CVE-2023-27524
published 2023-04-24CVE-2023-27524: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-01-29
Exploited in the wild
EPSS
97.41%
99.9th percentile
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:
SECRET_KEY =
Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | <= 2.0.1 | — |
| apache_software_foundation | apache_superset | <= 2.0.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect forged Flask session cookies by checking for the known default SECRET_KEY values used in Apache Superset. A valid session cookie signed with a default key indicates exploitation of CVE-2023-27524. ↗
- →Monitor HTTP requests to /api/v1/database/ endpoints with a session cookie. Successful 200 responses containing 'database_name' and 'configuration_method' fields indicate authenticated access via a forged cookie. ↗
- →Alert on HTTP responses to /api/v1/database/ that contain both '"database_name":' and '"configuration_method":' in the body, which confirms successful authentication bypass and database credential exposure. ↗
- →Detect exploitation attempts by scanning for Shodan/FOFA fingerprints: Apache Superset favicon hash 1582430156 or HTML containing 'Apache Superset', which identifies exposed vulnerable instances. ↗
- →The exploit decodes the existing session cookie, replaces _user_id and user_id with 1 (admin), re-signs with the default key, and submits to /superset/welcome. Monitor for session cookie replacement patterns targeting admin user ID 1. ↗
- →The Metasploit module achieves RCE by injecting a pickled Python payload into a Superset dashboard database entry. Monitor for unusual dashboard creation or modification activity combined with pickle deserialization patterns. ↗
- ·Only Apache Superset installations that have NOT changed the default SECRET_KEY are vulnerable. Instances with a custom SECRET_KEY are not affected. ↗
- ·Three distinct default SECRET_KEY values are known to be in use across different deployment contexts (deployment template, documentation, and docker-compose), all of which are exploitable. ↗
- ·The SECRET_KEY is used to securely sign ALL session cookies and encrypt sensitive information in the database, meaning compromise of the key exposes all session data and stored credentials. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.9HIGH
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache Superset Insecure Default Initialization of Resource Vulnerability
cisa·2024-01-08·CVSS 9.8
CVE-2023-27524 [CRITICAL] CWE-1188 Apache Superset Insecure Default Initialization of Resource Vulnerability
Vulnerability: Apache Superset Insecure Default Initialization of Resource Vulnerability
Affected: Apache Superset
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk; https://nvd.nist.gov/vuln/detail/CVE-2023-27524
Remediation Due Date: 2024-01-29
GHSA
Apache superset missing check for default SECRET_KEY
ghsa·2023-04-24
CVE-2023-27524 [HIGH] CWE-1188 Apache superset missing check for default SECRET_KEY
Apache superset missing check for default SECRET_KEY
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
OSV
Apache superset missing check for default SECRET_KEY
osv·2023-04-24
CVE-2023-27524 [HIGH] Apache superset missing check for default SECRET_KEY
Apache superset missing check for default SECRET_KEY
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
VulnCheck
Apache Superset Insecure Default Initialization of Resource Vulnerability
vulncheck·2023·CVSS 8.9
CVE-2023-27524 [HIGH] CWE-1188 Apache Superset Insecure Default Initialization of Resource Vulnerability
Apache Superset Insecure Default Initialization of Resource Vulnerability
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
Affected: Apache Superset
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.horizon3.ai/analysis-of-2023s-known-exploited-vulnerabilities/; https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF; https://5943619.hs-
No detection rules found.
Exploit-DB
Apache Superset 2.0.0 - Authentication Bypass
exploitdb·2023-05-23·CVSS 8.9
CVE-2023-27524 [HIGH] Apache Superset 2.0.0 - Authentication Bypass
Apache Superset 2.0.0 - Authentication Bypass
---
# Exploit Title: Apache Superset 2.0.0 - Authentication Bypass
# Date: 10 May 2023
# Exploit Author: MaanVader
# Vendor Homepage: https://superset.apache.org/
# Version: Apache Superset= 1.4.1
b'thisISaSECRET_1234', # deployment template
b'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY', # documentation
b'TEST_NON_DEV_SECRET' # docker compose
]
def main():
parser = argparse.ArgumentParser()
parser.add_argument('--url', '-u', help='Base URL of Superset instance', required=True)
parser.add_argument('--id', help='User ID to forge session cookie for, default=1', required=False, default='1')
args = parser.parse_args()
try:
u = args.url.rstrip('/') + '/login/'
headers = {
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:101.0) Gecko/20
Metasploit
Apache Superset Signed Cookie RCE
metasploit
Apache Superset Signed Cookie RCE
Apache Superset Signed Cookie RCE
Apache Superset versions <= 2.0.0 utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user. From there the Superset database is mounted, and credentials are pulled. A dashboard is then created. Lastly a pickled python payload can be set for that dashboard within Superset's database which will trigger the RCE. An attempt to clean up ALL of the dashboard key values and reset them to their previous values happens during the cleanup phase.
Nuclei
Piwigo 13.7.0 - SQL Injection
nuclei·CVSS 8.8
CVE-2023-37270 [HIGH] Piwigo 13.7.0 - SQL Injection
Piwigo 13.7.0 - SQL Injection
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents
Nuclei
Apache Superset - Authentication Bypass
nuclei·CVSS 9.8
CVE-2023-27524 [CRITICAL] Apache Superset - Authentication Bypass
Apache Superset - Authentication Bypass
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
Template:
id: CVE-2023-27524
info:
name: Apache Superset - Authentication Bypass
author: DhiyaneshDK,_0xf4n9x_
severity: critical
description: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauth
Metasploit
Apache Superset Signed Cookie Priv Esc
metasploit
Apache Superset Signed Cookie Priv Esc
Apache Superset Signed Cookie Priv Esc
Apache Superset versions <= 2.0.0 utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user and retrieve database credentials saved in Apache Superset.
arXiv
SCyTAG: Scalable Cyber-Twin for Threat-Assessment Based on Attack Graphs
arxiv_fulltext·2025-12-27
SCyTAG: Scalable Cyber-Twin for Threat-Assessment Based on Attack Graphs
SCyTAG: Scalable Cyber-Twin for Threat-Assessment Based on Attack Graphs
David Tayouri^1,
Elad Duani^1,
Abed Showgan^1,
Ofir Manor^2,
Ortal Lavi^2,
Igor Podoski^3,
Miro Ohana^1,
Yuval Elovici^1,
Andres Murillo^2,
Asaf Shabtai^1,
Rami Puzis^1
^1 Ben-Gurion University of the Negev,
^2 Fujitsu Research Europe,
^3 Fujitsu Technology Solutions
\davidtay,duani,miromeir\@post.bgu.ac.il, [email protected], \ofir.manor,ortal.lavi,igor.podoski,andres.murillo\@fujitsu.com, \elovici,shabtaia,puzis\@bgu.ac.il
comment
David Tayouri
Ben-Gurion University of the Negev
[email protected]
Elad Duani
Ben-Gurion University of the Negev
[email protected]
Abed Showgan
Ben-Gurion University of the Negev
[email protected]
Ofir Manor
Fujitsu Research Europe
[email protected]
Ort
Bleepingcomputer
CISA warns agencies of fourth flaw used in Triangulation spyware attacks
blogs_bleepingcomputer·2024-01-09·CVSS 5.3
[MEDIUM] CISA warns agencies of fourth flaw used in Triangulation spyware attacks
## CISA warns agencies of fourth flaw used in Triangulation spyware attacks
## Bill Toulas
The U.S. Cybersecurity and Infrastructure Security Agency has added to its to the Known Exploited Vulnerabilities catalog six vulnerabilities that impact products from Apple, Adobe, Apache, D-Link, and Joomla.
The Known Exploited Vulnerabilities catalog, or KEV for short, contains security issues that have been actively exploited in the wild. It is a valuable resource for organizations across the globe in the vulnerability management and prioritization process.
"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise." reads CISA's notice .
CISA has given federal agencies until January 29 to patch the six actively
Wiz
Crying Out Cloud - April Newsletter | Wiz
blogs_wiz·2023-05-01·CVSS 7.8
[HIGH] Crying Out Cloud - April Newsletter | Wiz
Cloud security is constantly evolving, and the Wiz Research team is dedicated to keeping you informed. The past month has seen significant vulnerabilities discovered, and there have been a few security incidents affecting cloud users.
We've compiled a shortlist of the most relevant developments. Here are our top picks!
## ✨ Highlights
## BrokenSesame : Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services
Wiz Research has discovered a chain of critical vulnerabilities in two of Alibaba Cloud׳s popular services, AsparaDB RDS for PostrgreSQL and AnalyticDB for PostgreSQL. Dubbed "BrokenSesame", the vulnerabilities allowed unauthorized cross-tenant access to other customers` PostgreSQL databases and the ability to perform a supply-chai
https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xykhttps://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.htmlhttps://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.htmlhttps://www.openwall.com/lists/oss-security/2023/04/24/2https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xykhttps://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.htmlhttps://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.htmlhttps://www.openwall.com/lists/oss-security/2023/04/24/2https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524
2023-04-24
Published
2024-01-08
Added to CISA KEV
Exploited in the wild