CVE-2023-27524

Known Exploited Vulnerability

Apache Superset Insecure Default Initialization of Resource Vulnerability

Vendor / product: Apache / Superset

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

Weakness classification

• security@apache.org: CWE-1188
• nvd@nist.gov: CWE-1188

Primary references

• security@apache.org — Mailing List, Vendor Advisory
• security@apache.org — Exploit, Third Party Advisory, VDB Entry
• security@apache.org — Exploit, Third Party Advisory, VDB Entry
• security@apache.org — Mailing List
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory, US Government Resource