Apache Superset: Privilege escalation with default examples database

CVE-2023-40610: Apache Superset Privilege Escalation

The vulnerability is an improper authorization check in Apache Superset versions prior to 2.1.2. The default examples database connection includes access to both the examples schema and Superset's metadata database. An attacker can exploit this by sending a specially crafted Common Table Expression (CTE) SQL statement that bypasses the intended SELECT-only restriction on metadata tables. [1][3]

To exploit, an attacker needs access to SQL Lab and the ability to query the examples database. By using the WITH ... AS ... RETURNING syntax, the attacker can perform INSERT, UPDATE, or DELETE operations on tables such as ab_user and ab_user_role, which are normally read-only. [3] This can be done without needing administrative privileges.

Successful exploitation allows the attacker to create new users, modify user roles, and escalate privileges to administrator. [3] Additionally, modifying the key_value table could potentially lead to remote code execution (RCE) due to insecure deserialization. [3] This undermines the authentication and authorization mechanisms of Superset.

The vulnerability is fixed in Apache Superset version 2.1.2. [1] Users are advised to upgrade. As a workaround, administrators can restrict access to the examples database or enforce stricter database permissions. [4]