Critical Auth Bypass and RCE Vulnerability in Apache Superset

Apache Superset has been found to have a critical security vulnerability, CVE-2023-27524, that allows for authentication bypass and remote code execution (RCE). This flaw arises from a default insecure configuration, specifically a predictable Flask secret key, affecting numerous instances of Superset. Attackers can exploit this vulnerability to gain administrative privileges, access user credentials, and compromise sensitive data. The vulnerability impacts all Superset versions up to 2.0.1 if the default SECRET_KEY has not been changed. A proof-of-concept exploit has been developed, demonstrating the ability to validate the vulnerability and execute commands on the server. Organizations using Apache Superset are urged to update their configurations and apply necessary patches to mitigate this risk. The vulnerability was first disclosed on April 24, 2023, and has been actively exploited since January 2024. The situation remains critical for unpatched installations.

Key Points: • CVE-2023-27524 allows for authentication bypass and RCE in Apache Superset. • The vulnerability affects all Superset versions up to 2.0.1 with default SECRET_KEY. • Active exploitation has been confirmed, necessitating immediate action from affected organizations.