Apache Superset stored XSS on Dashboard markdown

Apache Superset up to and including version 0.38.0 allowed users to create Markdown components on dashboard pages for describing chart-related information. This functionality lacked proper input sanitization, enabling an attacker to inject arbitrary JavaScript code into a Markdown element [1][4]. The vulnerability is exploited by crafting a "div" section and embedding within it an "svg" element containing malicious JavaScript [1].

To trigger the attack, the attacker must have the ability to create or edit dashboards, which typically requires authenticated access with at least editor-level privileges. Once a dashboard containing the malicious Markdown component is visited by any legitimate user, the injected JavaScript executes automatically in the context of the victim's browser [1]. This is a classic stored (persistent) cross-site scripting (XSS) attack.

Successful exploitation allows the attacker to perform arbitrary actions in the victim's browser session, such as stealing session cookies, exfiltrating sensitive data displayed on the dashboard, performing actions on behalf of the user, or defacing the dashboard page [1]. The impact is limited by the privileges of the viewing user but can lead to compromise of the Superset instance and its data.

Apache released a patched version to address this vulnerability. Users are strongly advised to upgrade to a version later than 0.38.0. No workaround is mentioned in the available references, so upgrading is the recommended mitigation [2][4].