CVE-2023-40610: Apache Superset: Privilege escalation with default examples database
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f678-j579-4xf5. This link is maintained to preserve external references.
Original Description
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
Other sources
Overview An attacker with access to the SQL Lab and the abuser and abuserrole tables can elevate his privileges to become administrator.
Details On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of the table keyvalue can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability).
Proof of Concept Some tables are supposed to accept only SELECT requests from the SQL tab. - Attempt to create a new user injectedadmin into the abuser table: PoC1
But this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query. INSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax: WITH a AS ( INSERT INTO abuser (id, firstname, lastname, username, email, password) VALUES (2, ‘injectedadmin’, ‘injectedadmin’, ‘injectedadmin’, ‘injectedadmin@gmail.com’, ‘{PASSWORDHASH}’) RETURNING id ) SELECT FROM a; PoC2 - injectedadmin added to the abuser table: PoC3
This method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables abuserrole can escalate his privilege to become administrator. - Locating the ID of the user ‘Auditeur B’, who has no rights and is not an admin. The request is done being ‘Auditeur B’: PoC4 - Locating the rows that keep the role of the user ‘Auditeur B’. The row 36 stores the value 3, indicating the role ‘Alpha’ for ‘Auditeur B’: PoC5 - Modification of the row 36 with an UPDATE request embedded in a WITH request: PoC6 - ‘Auditeur B’ role has been changed to Admin: PoC7
This technique can also be used to inject or modify values of the table keyvalue, which can potentially lead to a Remote Code Execution (cf. ...).
Solution Orange recommendation To fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests. Security patch Upgrade to Superset version 2.1.2.
References https://nvd.nist.gov/vuln/detail/CVE-2023-40610 https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot
Credits LEXFO for [Orange Innovation][orange]
[Orange CERT-CC][ora] at [Orange group][orange]
[ora]: <https://cert.orange.com/> [orange]: <https://www.orange.com/>
Timeline Date reported: July 27, 2023 Date fixed: November 27, 2023
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40610?
CVE-2023-40610 is a vulnerability in Apache Superset that allows for privilege escalation with the default examples database.
What is the severity of CVE-2023-40610?
CVE-2023-40610 has a severity rating of 6.3, which is considered medium.
How does CVE-2023-40610 affect Apache Superset?
CVE-2023-40610 affects Apache Superset up to but excluding version 2.1.2.
How can an attacker exploit CVE-2023-40610?
An attacker can exploit CVE-2023-40610 by using a specially crafted CTE SQL statement with the default examples database connection.
Are there any references for CVE-2023-40610?
Yes, you can find more information about CVE-2023-40610 at the following references: [Reference 1](https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot), [Reference 2](http://www.openwall.com/lists/oss-security/2023/11/27/2), [Reference 3](https://nvd.nist.gov/vuln/detail/CVE-2023-40610).