CVE-2023-40610
published 2023-11-27CVE-2023-40610: Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection…
PriorityP358high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.33%
67.9th percentile
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | < 2.1.2 | 2.1.2 |
| apache_software_foundation | apache_superset | < 2.1.2 | 2.1.2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Superset - Elevation of Privilege
ghsa·2023-11-28·CVSS 8.8
CVE-2023-40610 [HIGH] CWE-863 Apache Superset - Elevation of Privilege
Apache Superset - Elevation of Privilege
### Overview
An attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.
### Details
On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords.
Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability).
### Proof of Concept
Some tables are supposed to accept only SELECT requests from the SQL tab.
- Attempt to create a new user injected_admin into the ab_user table: [PoC_1](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_1.png)
But this pro
OSV
Apache Superset - Elevation of Privilege
osv·2023-11-28·CVSS 8.8
CVE-2023-40610 [HIGH] Apache Superset - Elevation of Privilege
Apache Superset - Elevation of Privilege
### Overview
An attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.
### Details
On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords.
Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability).
### Proof of Concept
Some tables are supposed to accept only SELECT requests from the SQL tab.
- Attempt to create a new user injected_admin into the ab_user table: [PoC_1](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_1.png)
But this pro
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/11/27/2https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rothttp://www.openwall.com/lists/oss-security/2023/11/27/2https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot
2023-11-27
Published