QID 730792

Apache Superset is a modern, enterprise-ready business intelligence web application. It is fast, lightweight, intuitive, and loaded with options that make it easy for users of all skill sets to explore and visualize their data, from simple pie charts to highly detailed deck.gl geospatial charts.

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Affected Versions:
Apache Superset versions up to and including 2.0.1

NOTE:
POC will be executed only if target is using default SECRET KEY

QID Detection Logic(Unauthenticated):
This QID checks for vulnerable version of Apache Superset by sending GET request "/api/v1/me/", "/api/v1/database/_info" with pre-defined valid session cookie in COOKIE header created using default SECRET KEY and fetch user info or database info of the target. Also send GET request to "/login/" and looks for vulnerable version if in case Proof-of-Concept didn't executed.

Successful exploitation of this vulnerability may allow for an attacker to authenticate and access unauthorized resources and may execute arbitrary code on the target system.