apache-superset@1.0.0 vulnerabilities

A modern, enterprise-ready business intelligence web application

Direct Vulnerabilities

Known vulnerabilities in the apache-superset package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the "Dashboard Title" and "Chart Title" due to improper user input sanitization. An authenticated attacker with create/update permissions could inject a malicious script or HTML snippet, leading to the execution of arbitrary code in the context of the user's browser session.

Note

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}

How to fix Cross-site Scripting (XSS)?

Upgrade apache-superset to version 3.0.3 or higher.

[,3.0.3)
  • M
Uncontrolled Resource Consumption

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption. An authenticated attacker can trigger this vulnerability by uploading a malicious ZIP file to import databases, dashboards, or datasets.

How to fix Uncontrolled Resource Consumption?

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

[,2.1.3) [3.0.0,3.0.2)
  • M
SQL Injection

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection via the where_in JINJA macro which allows users to specify a quote. An attacker can manipulate SQL queries by crafting malicious input that exploits the quoting mechanism.

How to fix SQL Injection?

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

[,2.1.3) [3.0.0,3.0.2)
  • H
Incorrect Authorization

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access controls. An authenticated Gamma user can exploit this by creating a dashboard and adding charts to it, which erroneously grants them ownership and write permissions to those charts.

How to fix Incorrect Authorization?

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

[,2.1.3) [3.0.0,3.0.2)
  • M
Allocation of Resources Without Limits or Throttling

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An authenticated attacker can initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to denial of service.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade apache-superset to version 2.1.3, 3.0.0 or higher.

[,2.1.3) [3.0.0rc1,3.0.0)
  • M
Incorrect Default Permissions

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Default Permissions. An authenticated user can read configured CSS templates and annotations by exploiting the unnecessary read permissions within the Gamma role.

Note:

In addition to updating to the fixed version, users should run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

How to fix Incorrect Default Permissions?

Upgrade apache-superset to version 2.1.2 or higher.

[,2.1.2)
  • M
Open Redirect

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Open Redirect when the dataset link updating process is manipulated. An attacker can change a dataset link to an untrusted site by spoofing the HTTP Host header. This is only exploitable if the attacker is authenticated and has update datasets permission.

How to fix Open Redirect?

Upgrade apache-superset to version 3.0.0 or higher.

[,3.0.0)
  • M
Cross-site Scripting (XSS)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper payload validation and an improper REST API response type, allowing an authenticated malicious actor to store malicious code into Chart's metadata. This code could get executed when a user accesses a specific deprecated API endpoint.

How to fix Cross-site Scripting (XSS)?

Upgrade apache-superset to version 2.1.2 or higher.

[,2.1.2)
  • M
Incorrect Authorization

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can escalate privileges and tamper with authentication/authorization data by using a specially crafted CTE SQL statement.

Note:

This is only exploitable if the default "examples" database connection is used, which allows access to both the examples schema and the metadata database.

How to fix Incorrect Authorization?

Upgrade apache-superset to version 2.1.2 or higher.

[,2.1.2)
  • M
Information Exposure

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Information Exposure. An authenticated attacker with read permissions on database connections metadata can access sensitive information such as the connection's username by exploiting this vulnerability.

How to fix Information Exposure?

Upgrade apache-superset to version 3.0.0 or higher.

[,3.0.0)
  • M
Information Exposure

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Information Exposure such that by default, stack traces for errors are enabled, which results in the exposure of internal traces on REST API endpoints to users.

How to fix Information Exposure?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Improper Preservation of Permissions

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Preservation of Permissions. An improper default REST API permission for Gamma users allows for an authenticated Gamma user to test database connections.

How to fix Improper Preservation of Permissions?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • L
Improper Input Validation

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Input Validation due to allowing SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could lead to unexpected file creation on Superset webservers.

Note:

If Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity.

How to fix Improper Input Validation?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Server-side Request Forgery (SSRF)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper REST API permission which allows authenticated Gamma users to test network connections.

How to fix Server-side Request Forgery (SSRF)?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Incorrect Authorization

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to allowing an authenticated user to issue queries on database tables they may not have access to.

How to fix Incorrect Authorization?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Incorrect Authorization

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to allowing an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

How to fix Incorrect Authorization?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Access Restriction Bypass

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Access Restriction Bypass via import charts feature, allowing a non Admin authenticated user to incorrectly create resources.

How to fix Access Restriction Bypass?

Upgrade apache-superset to version 2.1.1 or higher.

[,2.1.1)
  • M
Server-side Request Forgery (SSRF)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed.

How to fix Server-side Request Forgery (SSRF)?

Upgrade apache-superset to version 2.1.0 or higher.

[,2.1.0)
  • H
Insecure Default Initialization of Resource

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the use of a default SECRET_KEY that could be abused by attackers to authenticate and access unauthorized resources on internet-exposed installations.

Impact: An attacker who has knowledge of the secret key can sign in to the vulnerable servers as an administrator by forging a session cookie and can seize control of the systems.

Note: This issue does not affect configurations in which the default value for SECRET_KEY config was changed.

How to fix Insecure Default Initialization of Resource?

Upgrade apache-superset to version 2.1.0 or higher.

[,2.1.0)
  • L
Access Restriction Bypass

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Access Restriction Bypass. An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods.

How to fix Access Restriction Bypass?

Upgrade apache-superset to version 2.1.0 or higher.

[,2.1.0)
  • L
Open Redirect

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Open Redirect that allows authenticated users with update datasets permission to change a dataset link to an untrusted site.

How to fix Open Redirect?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
Cross-site Request Forgery (CSRF)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the /superset/approval and /superset/request_access endpoints.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') due to improper escape of HTML characters, which allows creating a record with specific HTML tags, that will trigger the exploitation via the toast message displayed when the user deletes the crafted CSS template record.

NOTE: Exploiting this vulnerability is possible by an authenticated attacker with write CSS template permissions.

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
Improper Access Control

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Access Control which allows an unauthenticated user to access the dashboard configuration metadata using the REST API Get endpoint. Exploiting this vulnerability is only possible when enabling the feature flag DASHBOARD_CACHE.

How to fix Improper Access Control?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
SQL Injection

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection via the SQL Alchemy connector, which allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag ALLOW_ADHOC_SUBQUERY disabled (default value).

How to fix SQL Injection?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
Cross-site Scripting (XSS)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper content sanitization of the markdown components in the dashboard rendering process. Exploiting this vulnerability is possible by authenticated users with create dashboard permissions.

How to fix Cross-site Scripting (XSS)?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • L
Cross-site Scripting (XSS)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions.

How to fix Cross-site Scripting (XSS)?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

[,1.5.3) [2.0.0,2.0.1)
  • M
Information Exposure

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Information Exposure in the form of dataset metadata, including dataset name, columns, and metrics.

How to fix Information Exposure?

Upgrade apache-superset to version 1.5.1 or higher.

[,1.5.1)
  • C
SQL Injection

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection in chart data requests.

How to fix SQL Injection?

Upgrade apache-superset to version 1.4.2 or higher.

[,1.4.2)
  • M
Insufficiently Protected Credentials

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials which allows registered database connections password leak for authenticated users.

How to fix Insufficiently Protected Credentials?

Upgrade apache-superset to version 1.4.0 or higher.

[,1.4.0)
  • H
Improper Output Neutralization for Logs

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via HTTP endpoint which allowed for an authenticated user to forge log entries or inject malicious content into logs.

How to fix Improper Output Neutralization for Logs?

Upgrade apache-superset to version 1.3.2 or higher.

[,1.3.2)
  • M
Improper Output Neutralization for Logs

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via HTTP endpoint which allowed for an authenticated user to forge log entries or inject malicious content into logs.

How to fix Improper Output Neutralization for Logs?

Upgrade apache-superset to version 1.3.2 or higher.

[,1.3.2)
  • M
Insufficiently Protected Credentials

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via database connections password leak for authenticated users.

How to fix Insufficiently Protected Credentials?

Upgrade apache-superset to version 1.3.2 or higher.

[,1.3.2)
  • M
Cross-site Scripting (XSS)

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.

How to fix Cross-site Scripting (XSS)?

Upgrade apache-superset to version 1.2.0 or higher.

[,1.2.0)
  • M
SQL Injection

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection. When configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) it allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.

How to fix SQL Injection?

Upgrade apache-superset to version 1.3.1 or higher.

[,1.3.1)
  • M
Open Redirect

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Open Redirect. Insufficient user input validation of open redirects, the URL shortener functionality allows a malicious user to create a short URL for a dashboard and convince the user to click the link.

How to fix Open Redirect?

Upgrade apache-superset to version 1.1.0 or higher.

[,1.1.0)