antx-code / CVE-2023-27524

Apache Superset Auth Bypass Vulnerability CVE-2023-27524.

CVE-2023-27524

---

Description

• POC for CVE-2023-27524: Apache Superset Auth Bypass Vulnerability.
• create by antx at 2023-04-27.

---

Detail

• Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

---

CVE Severity

• attackComplexity: HIGH
• attackVector: NETWORK
• availabilityImpact: LOW
• confidentialityImpact: HIGH
• integrityImpact: HIGH
• privilegesRequired: NONE
• scope: CHANGED
• userInteraction: NONE
• version: 3.1
• baseScore: 8.9
• baseSeverity: HIGH

---

Affect

• Apache Superset
  • <= 2.0.1

---

POC

• Poc

---

Patch

• vendor patch

---

Reference

• Ref-Source
  • https://twitter.com/momika233/status/1651276901821067265
  • Create CVE-2023-27524.yaml #7125
• CVE
  • CVE-2023-27524
• NVD
  • CVE-2023-27524
• Ref-Poc-Engine
  • pocx