Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Vulnerability

Analysis

CVE-2024-53947 is a SQL injection vulnerability in Apache Superset affecting versions prior to 4.1.0. The root cause is an incomplete blocklist of dangerous PostgreSQL functions. Specifically, functions related to XML generation—query_to_xml_and_xmlschema, table_to_xml, and table_to_xml_and_xmlschema—were not included in the DISALLOWED_SQL_FUNCTIONS configuration. This oversight follows a previous fix for CVE-2024-39887, which already blocked similar functions like query_to_xml and inet_server_addr [1][3].

Exploitation

An attacker who can submit SQL queries through Apache Superset's SQL Lab or chart interfaces can supply a crafted query that invokes one of these unblocked PostgreSQL functions. No special authentication beyond normal SQL query access is required. The attacker does not need to be a database administrator; the SQL authorization bypass occurs because the engine-specific function filters are not applied [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the connected PostgreSQL database. This can lead to unauthorized data access, data manipulation, or further database compromise, depending on the privileges of the database user configured for the Superset instance [1].

Mitigation

The Apache Superset project has released version 4.1.0, which adds the missing functions to the disallowed list [3]. Users who cannot upgrade immediately can manually add these functions (query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema) to the DISALLOWED_SQL_FUNCTIONS configuration parameter for the PostgreSQL engine [1].