CVE-2024-39887
published 2024-07-16CVE-2024-39887: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
4.43%
90.3th percentile
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.
This issue affects Apache Superset: before 4.0.2.
Users are recommended to upgrade to version 4.0.2, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | < 4.1.0 | 4.1.0 |
| apache | superset | < 4.0.2 | 4.0.2 |
| apache_software_foundation | apache_superset | < 4.1.0 | 4.1.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect SQL queries submitted to Apache Superset containing the PostgreSQL functions query_to_xml_and_xmlschema, table_to_xml, or table_to_xml_and_xmlschema, which are used to bypass SQL authorization controls. ↗
- →A Sigma rule with digest 4b0a00483046022100b3377a7c048511ffe553493f39335704978d20c6f66c356a2306f3245deddad8022100f17c68d56b08fce34cc59ad3453f2244fadae21a6153fef290d0595cb1091412:922c64590222798bb761d5b6d8e72950 is associated with detection of Apache Superset SQL injection abuse.
- ·The three newly disallowed PostgreSQL functions (query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema) must be explicitly added to the DISALLOWED_SQL_FUNCTIONS config set on Apache Superset versions prior to 4.1.0 as a workaround. ↗
- ·This CVE is a follow-up to CVE-2024-39887; deployments that patched CVE-2024-39887 may still be vulnerable if they have not also blocked the three additional PostgreSQL functions introduced in CVE-2024-53947. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
osv·2024-12-09·CVSS 9.8
CVE-2024-53947 [CRITICAL] Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.
This issue affects Apache Superset: <4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
GHSA
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
ghsa·2024-12-09·CVSS 9.8
CVE-2024-53947 [CRITICAL] CWE-89 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.
This issue affects Apache Superset: <4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
GHSA
Apache Superset vulnerable to improper SQL authorization
ghsa·2024-07-16
CVE-2024-39887 [MEDIUM] CWE-89 Apache Superset vulnerable to improper SQL authorization
Apache Superset vulnerable to improper SQL authorization
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.
This issue affects Apache Superset: before 4.0.2.
Users are recommended to upgrade to version 4.0.2, which fixes the issue.
OSV
Apache Superset vulnerable to improper SQL authorization
osv·2024-07-16
CVE-2024-39887 [MEDIUM] Apache Superset vulnerable to improper SQL authorization
Apache Superset vulnerable to improper SQL authorization
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.
This issue affects Apache Superset: before 4.0.2.
Users are recommended to upgrade to version 4.0.2, which fixes the issue.
No detection rules found.
Nuclei
Apache Superset < 4.0.2 - SQL Injection
nuclei·CVSS 9.8
CVE-2024-39887 [CRITICAL] Apache Superset < 4.0.2 - SQL Injection
Apache Superset {{marker}}")'
condition: and
# digest: 4b0a00483046022100b3377a7c048511ffe553493f39335704978d20c6f66c356a2306f3245deddad8022100f17c68d56b08fce34cc59ad3453f2244fadae21a6153fef290d0595cb1091412:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2024-07-16
Published