Apache Superset: Incorrect datasource authorization on explore REST API

Vulnerability

Overview

CVE-2024-28148 is an authorization bypass vulnerability in Apache Superset's REST API. The root cause is insufficient access control checks on specific API endpoints, allowing an authenticated user to retrieve metadata for a datasource they are not authorized to view [1].

Exploitation

An attacker must be an authenticated user of Apache Superset. By crafting a targeted REST API request, they can bypass the intended access restrictions and obtain metadata such as table names, column details, and other schema information for a restricted datasource. No additional privileges beyond authentication are required [1].

Impact

Successful exploitation leads to unauthorized disclosure of datasource metadata. This could expose sensitive database schema details, potentially aiding further attacks or leaking business-critical information about data structures [1].

Mitigation

The vulnerability is fixed in Apache Superset version 3.1.2. Users are recommended to upgrade to this version or later. No workarounds have been provided [1].