Service Notices

All Notices > Security Notices > Apache Superset Identity Authentication Bypass Vulnerability (CVE-2023-27524)

Apache Superset Identity Authentication Bypass Vulnerability (CVE-2023-27524)

Apr 28, 2023 GMT+08:00

I. Overview

Recently, Apache Superset has released an official security notice, disclosing an identity authentication bypass vulnerability (CVE-2023-27524) in Apache Superset 2.0.1 and earlier. Apache Superset has insecure default settings. Systems that keep the default SECRET_KEY value without changing it following the installation guide are exposed to this vulnerability. Unauthorized attackers can exploit this vulnerability to access restricted resources or run arbitrary code. Currently, the vulnerability exploitation details have been disclosed, and the risk is high.

Apache Superset is an open-source software application for data exploration and data visualization. It can process petabyte-scale data. If you are an Apache Superset user, check your system and implement timely security hardening.

References:

https://www.cve.org/CVERecord?id=CVE-2023-27524

https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Affected versions:

Apache Superset<= 2.0.1

Secure versions:

Apache Superset >= 2.1.0

IV. Vulnerability Handling

This vulnerability has been fixed in the latest official version. If your service version falls into the affected range, upgrade it to the secure version.

https://www.apache.org/dist/superset/2.1.0

If you cannot perform the upgrade in a timely manner, you can change the default value of SECRET_KEY. For details, see the official guide.

https://superset.apache.org/docs/installation/configuring-superset/#secret_key-rotation

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.