Metasploit Weekly Wrap-Up

That Privilege Escalation Escalated Quickly This release features a module leveraging CVE-2023-22515, a vulnerability in Atlassian’s on-premises Confluence Server first listed as a privilege escalation, but quickly recategorized as a “broken access control” with a CVSS score of 10. The exploit...

Apache Superset 2.0.0 Remote Code Execution Exploit

Apache Superset versions 2.0.0 and below utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their userid to that of an administrator, and re-sign the cooki...

Apache Superset 2.0.0 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Superset Signed Cookie RCE', 'Description' = %q Apache Superset versions MSFLICENSE, 'Author' = 'h00die', MSF module 'paradoxis', original...

The vulnerability of the Apache Superset data visualization software lies in authentication errors, which allow an attacker to gain read access to the database.

The vulnerability of the Apache Superset data visualization software is related to authentication errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to the database...

Metasploit Weekly Wrap-Up

Flask Cookies This week includes two modules related to Flask cookie signatures. One is specific to Apache Superset where session cookies can be resigned, allowing an attacker to elevate their privileges and dump the database connection strings. While adding this functionality, community member...

The vulnerability of Apache Superset’s data visualization software lies in insufficient validation of input data. This allows attackers to create arbitrary files and gain unauthorized access to protected information.

The vulnerability of Apache Superset’s data visualization software relates to the use of alternative driver names during database import. Exploiting this vulnerability allows an attacker to create arbitrary files and gain unauthorized access to protected information by connecting to SQLite...

The vulnerability of the Apache Superset data visualization software lies in its deserialization mechanism’s flaws, allowing for arbitrary code execution.

The vulnerability of the Apache Superset visualization software lies in the shortcomings of its deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Missing Authorization

Apache Superset is vulnerable to Improper Authorization in the SQLLab component. The vulnerability is due to an incorrect authorization check in Apache Superset which allows an attacker to query tables that they do not have proper access to within Superset...

Improper Input Validation

apache-superset is vulnerable to Improper Input Validation. The vulnerability allows an attacker to trick a user into potentially registering a SQLite database connection incorrectly if an attacker employs alternative driver names such as sqlite+pysqlite or utilizes database imports. This...

Apache Superset Security Bypass Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security bypass vulnerability exists in Apache Superset version 2.1.0 and prior versions, which can be exploited by an attacker to incorrectly create resources using the Import Chart feature...

Apache Superset Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions have an authorization issue vulnerability that stems from incorrect authorization checks in SQLLab. An attacker can exploit the vulnerability to...

Apache Superset REST API Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions suffer from an authorization issue vulnerability that stems from incorrect REST API permissions. An attacker can exploit this vulnerability to cau...

Apache Superset Code Execution Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A code execution vulnerability exists in Apache Superset version 2.1.0 and earlier, which can be exploited by an attacker to remotely execute code on a Web backend...

Apache Superset Security Bypass Vulnerability (CNVD-2024-06820)

Apache Superset is an open source data visualization tool based on Python. Apache Superset suffers from a security bypass vulnerability that can be exploited by an attacker to test a database connection...

Apache Superset Security Bypass Vulnerability (CNVD-2024-06819)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security bypass vulnerability exists in Apache Superset version 2.1.0 and earlier, which can be exploited by an attacker to register a SQLite database connection...

Apache Superset Information Disclosure Vulnerability (CNVD-2023-70276)

Apache Superset is an open source data visualization tool based on Python. A security vulnerability in the Apache Superset stack trace error handling can be exploited by a remote attacker to submit a special request that can obtain sensitive information...

Exploit for Insecure Default Initialization of Resource in Apache Superset

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Su...

Incorrect Authorization

Apache Superset is vulnerable to Incorrect Authorization. The vulnerability is caused by a missing user permissions check in the importchart method inside superset/charts/commands/importers/v1/utils.py. A non admin authenticated attacker can create resources incorrectly while using the import...

Apache Superset Unauthorized Access Vulnerability

Apache Superset is a Python language based development of open source fashionable data exploration and analysis and visualization of the reporting platform , support for rich data sources , and has a colorful visualization of the charts to choose from . An unauthorized access vulnerability exists...

Alert: Apache Superset Vulnerabilities Expose Servers to Remote Code Execution Attacks

Patches have been released to address two new security vulnerabilities in Apache Superset that could be exploited by an attacker to gain remote code execution on affected systems. The update version 2.1.1 plugs CVE-2023-39265 and CVE-2023-37941, which make it possible to conduct nefarious actions...