Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

Vulnerability

Description Apache Superset provides a security mechanism, DISALLOWED_SQL_FUNCTIONS, to block potentially dangerous SQL functions in SQL Lab and charts. While this dictionary was configured for databases like PostgreSQL, the default list for ClickHouse was incomplete, leaving it possible to execute functions that should have been prohibited [1][3].

Exploitation

An authenticated user with access to SQL Lab or chart querying can leverage these unblocked ClickHouse functions to extract sensitive information. The attack requires only the ability to write SQL queries against a ClickHouse datasource, which is a standard feature in Superset [3]. No special privileges beyond normal query access are needed.

Impact

Successful exploitation can lead to exposure of sensitive data stored in ClickHouse, potentially violating confidentiality requirements. The vulnerability is categorized as an information disclosure issue [1][3].

Mitigation

The vulnerability affects all Apache Superset versions before 4.1.2. Users should upgrade to version 4.1.2, which includes a complete default list of disallowed SQL functions for ClickHouse [1][3].