Apache Superset: Improper data authorization when creating a new dataset

Vulnerability

CVE-2024-24779 is a stored cross-site scripting (XSS) vulnerability in Apache Superset versions before 3.0.4 and 3.1.0 before 3.1.1. The flaw arises when a user creates or renames a dataset, as the application fails to sanitize the dataset name. Malicious dataset names can include JavaScript payloads that are then stored and later rendered without proper encoding on dashboard pages, especially on the dashboard list view [1].

Attack

Vector

An authenticated Superset user with the ability to create or edit datasets can craft a dataset name containing a malicious script (e.g., using ``). When an administrator or another user views the dashboard list, the payload executes in their browser. This is a stored XSS that does not require any additional interaction; merely navigating to the dashboard list triggers the exploit [1].

Impact

The attacker can execute arbitrary JavaScript in the context of the victim's session. This may allow hijacking of user sessions, performing actions on behalf of the victim, exfiltrating sensitive data, or defacing the application. Because the XSS fires in the context of the Superset web interface, the impact depends on the victim's privileges but can be severe for administrative users [1].

Mitigation

Apache has released Superset versions 3.0.4 and 3.1.1, which include input sanitization for dataset names to prevent XSS. All users should upgrade immediately. There are no known workarounds, but restricting dataset creation privileges to trusted users reduces exposure [1].