CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRETKEY according to installation instructions.
Other sources
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRETKEY config.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-supersetto a version that resolves this vulnerability.Fixed in 2.1.0 - Configuration
Add a strong SECRET_KEY to your superset_config.py file, for example: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>. Ensure the value is a unique, secure, randomly generated secret.
Apache Superset (superset_config.py) SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> - Configuration
Alternatively set the SUPERSET_SECRET_KEY environment variable to a unique, secure, randomly generated secret (e.g., export SUPERSET_SECRET_KEY="<YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>") before starting Superset.
Apache Superset (environment variable) SUPERSET_SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>
Event History
Frequently Asked Questions
What is CVE-2023-27524?
CVE-2023-27524 is a vulnerability in Apache Superset versions up to and including 2.0.1 that allows attackers to authenticate and access unauthorized resources if the default configured SECRET_KEY has not been altered.
What is the severity of CVE-2023-27524?
CVE-2023-27524 has a severity rating of critical with a score of 9.8 out of 10.
How does CVE-2023-27524 affect Apache Superset installations?
CVE-2023-27524 affects Apache Superset installations that have not altered the default configured SECRET_KEY according to installation instructions.
How can I fix CVE-2023-27524?
To fix CVE-2023-27524, upgrade to Apache Superset version 2.1.0 or later, as recommended by the vendor.
Where can I find more information about CVE-2023-27524?
You can find more information about CVE-2023-27524 on the NIST National Vulnerability Database (NVD) website and the Apache Superset mailing list.