Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Affects Apache Superset up to and including 2.0.1 on installations that kept the default SECRET_KEY. Fixed in 2.0.2 and 2.1.0.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.0.2, 2.1.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 2 Metasploit modules, 16 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
Apache Superset, a widely used open-source data exploration and visualization platform, is affected when it runs with the default SECRET_KEY that ships in its installation instructions and has not been changed. An attacker could exploit this to forge session cookies, authenticate as others, and access resources they should not be able to reach.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-51447
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache Superset
through 2.0.1
- supersetBitnami
fixed in 2.0.2
- apache-supersetPyPI
fixed in 2.1.0
References 24
lists.apache.org
openwall.com
packetstormsecurity.com
Exploit-DB
GitHub · rapid7/metasploit-framework
GitHub · projectdiscovery/nuclei-templates
GitHub · Ap0dexMe0/CVE-2023-27524
GitHub · CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-
GitHub · Cappricio-Securities/CVE-2023-27524
GitHub · CyberCTF/vulhub-superset-cve-2023-27524
GitHub · MaanVader/CVE-2023-27524-POC
GitHub · Okaytc/Superset_auth_bypass_check
GitHub · ZZ-SOCMAP/CVE-2023-27524
GitHub · h1n4mx0z/Research-CVE-2023-27524
GitHub · horizon3ai/CVE-2023-27524
GitHub · jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE
GitHub · karthi-the-hacker/CVE-2023-27524
GitHub · necroteddy/CVE-2023-27524
GitHub · rachidafaf/bola-CVE-2023-27524
GitHub · sifatnotes/secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs
GitHub · sumaiyafathima-code/CVE-2023-27524
GitHub · tardc/CVE-2023-27524
Questions about CVE-2023-27524
What does this mean?
A session validation flaw in Apache Superset lets an attacker authenticate and access resources they should not be able to reach. It occurs when the default SECRET_KEY is still in use.Source: openwall.com
Am I affected, and how do I check?
Apache Superset versions up to and including 2.0.1 are affected, but only on installations that did not change the default SECRET_KEY from the installation instructions. To check, look at the installed Superset version and at the SECRET_KEY value in the configuration file.Source: openwall.com
What should I do about it?
Upgrade to Apache Superset 2.0.2 or later, or to 2.1.0 or later. Also set a SECRET_KEY that differs from the default in the installation instructions.Source: openwall.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-01-08, which means it has evidence of attacks. Public exploit code exists (Exploit-DB, Metasploit, a Nuclei template, a proof of concept on GitHub).Source: cisa.gov, cve.now feed data