cbcvebase.
CVE-2023-37941
published 2023-09-06

CVE-2023-37941: If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote…

PriorityP274medium6.6CVSS 3.1
AVNACHPRHUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
29.23%
98.0th percentile
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

Affected

2 ranges
VendorProductVersion rangeFixed in
apachesuperset1.5.0 – 2.1.0—
apache_software_foundationapache_superset1.5.0 – 2.1.0—

Detection & IOCsextracted from sources · hover to see the quote

commandpickled python payload set for dashboard within Superset's database↗
cookieForged Flask signed session cookie with manipulated user_id set to administrator↗
  • →Detect use of known default Flask secret keys used to sign Superset session cookies; any session cookie signed with a known/default secret key should be treated as suspicious. ↗
  • →Monitor Superset metadata database for unexpected writes, especially insertion or modification of dashboard key values that may contain serialized (pickled) Python objects. ↗
  • →Alert on privilege escalation patterns in Superset: a non-admin user authenticating and then performing admin-level actions (e.g., database credential access, dashboard creation) within the same session may indicate cookie forgery exploitation. ↗
  • →Monitor for unexpected Python deserialization (pickle) activity originating from the Superset web backend process, which may indicate a crafted object was loaded from the metadata database. ↗
  • ·The attack requires write access to the Superset metadata database, which is normally restricted to the system administrator and the Superset process itself. Exploitation difficulty is high without prior significant privilege escalation. ↗
  • ·The cookie-forgery attack vector (Metasploit module) applies specifically to Superset versions <= 2.0.0 using a known default Flask SECRET_KEY. Instances that have rotated to a strong, unique secret key are not vulnerable to the cookie-forging step. ↗
  • ·CVE-2023-37941 affects Apache Superset versions 1.5.0 through 2.1.0 inclusive; upgrade to 2.1.1 or later to remediate. ↗

CVSS provenance

nvdv3.16.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
vulncheck6.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.