Apache Superset: Open Redirect Vulnerability

Vulnerability

Overview

CVE-2023-42502 is an open redirect vulnerability in Apache Superset versions prior to 3.0.0. The root cause is insufficient validation of the HTTP Host header when an authenticated user with update datasets permission modifies a dataset link. By spoofing the Host header, an attacker can change the dataset link to point to an arbitrary untrusted site [1][3].

Exploitation

To exploit this vulnerability, an attacker must have a valid authenticated session and possess the 'update datasets' permission. The attacker then crafts a request with a manipulated Host header, causing the dataset link to be stored with a malicious URL. When other users click on that dataset, they are redirected to the attacker-controlled site [3].

Impact

Successful exploitation results in an open redirect, which can be leveraged for phishing attacks, malware distribution, or other social engineering schemes. The redirection occurs without any warning to the user, increasing the likelihood of successful compromise [1].

Mitigation

Apache Superset version 3.0.0 and later include a fix for this issue. Users running earlier versions should upgrade to the latest release to eliminate the vulnerability. No workaround is documented [3].