Apache Superset: Dashboard metadata information leak

CVE-2022-45438 affects Apache Superset when the DASHBOARD_CACHE feature flag is explicitly enabled (disabled by default). The vulnerability allows an unauthenticated attacker to access dashboard configuration metadata through a REST API GET endpoint. This issue is present in Superset versions 1.5.2 and prior, as well as version 2.0.0 [1].

The attack does not require authentication, only that the DASHBOARD_CACHE flag is active. The REST API endpoint exposes sensitive metadata about dashboard configurations, which could include information about the structure and settings of dashboards [2].

Exploitation could lead to information disclosure, where an attacker gains insight into dashboard designs, data sources, or user-configured parameters. This information could be used for further attacks or to understand the system's configuration.

As of the advisory, it is recommended to ensure the DASHBOARD_CACHE feature flag is not enabled unless necessary. Users should upgrade to a patched version if available. The issue highlights the importance of careful feature flag management and authentication checks for REST APIs.