apache-superset@2.1.1rc1 vulnerabilities

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection by using engine-specific functions that are not adequately checked. This is only exploitable if the DISALLOWED_SQL_FUNCTIONS configuration is not set to disallow critical functions.

Upgrade apache-superset to version 4.0.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Arbitrary File Read by allowing an authenticated attacker to create a MariaDB connection with local_infile enabled. The attacker can read files from the server and insert their content into a MariaDB database table by executing specific MySQL/MariaDB SQL commands.

Note:

This is only exploitable if both the MariaDB server and the local mysql client on the web server are set to allow for local infile.

Upgrade apache-superset to version 3.1.3, 4.0.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to the improper handling of REST API requests. An authenticated attacker can access unauthorized metadata that they are not authorized to view by submitting a targeted request.

Upgrade apache-superset to version 3.1.2, 4.0.0rc2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Authorization on dashboards and charts import. A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object.

Note: The access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.

Upgrade apache-superset to version 3.0.4, 3.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. A user with Alerts & Reports privileges to create Alerts can cause a malicious SQL statement to throw and error and have its contents logged. Thee error is not properly handled and can expose sensitive data.

Upgrade apache-superset to version 3.0.4, 3.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Authorization when creating a new virtual dataset using custom roles that include "can write on dataset". This allows users to access data in other datasets to which they do not otherwise have access.

Upgrade apache-superset to version 3.0.4, 3.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization when processing nested SQL statements in SQLLab, allowing a user to access unauthorized data.

Upgrade apache-superset to version 3.0.4, 3.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection in an embedded context, allowing a guest user to expose information from the analytics database via chart data REST API call.

Upgrade apache-superset to version 3.0.4, 3.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the "Dashboard Title" and "Chart Title" due to improper user input sanitization. An authenticated attacker with create/update permissions could inject a malicious script or HTML snippet, leading to the execution of arbitrary code in the context of the user's browser session.

Note

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}

Upgrade apache-superset to version 3.0.3 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption. An authenticated attacker can trigger this vulnerability by uploading a malicious ZIP file to import databases, dashboards, or datasets.

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to SQL Injection via the where_in JINJA macro which allows users to specify a quote. An attacker can manipulate SQL queries by crafting malicious input that exploits the quoting mechanism.

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access controls. An authenticated Gamma user can exploit this by creating a dashboard and adding charts to it, which erroneously grants them ownership and write permissions to those charts.

Upgrade apache-superset to version 2.1.3, 3.0.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An authenticated attacker can initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to denial of service.

Upgrade apache-superset to version 2.1.3, 3.0.0 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Default Permissions. An authenticated user can read configured CSS templates and annotations by exploiting the unnecessary read permissions within the Gamma role.

Note:

In addition to updating to the fixed version, users should run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

Upgrade apache-superset to version 2.1.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Open Redirect when the dataset link updating process is manipulated. An attacker can change a dataset link to an untrusted site by spoofing the HTTP Host header. This is only exploitable if the attacker is authenticated and has update datasets permission.

Upgrade apache-superset to version 3.0.0 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper payload validation and an improper REST API response type, allowing an authenticated malicious actor to store malicious code into Chart's metadata. This code could get executed when a user accesses a specific deprecated API endpoint.

Upgrade apache-superset to version 2.1.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can escalate privileges and tamper with authentication/authorization data by using a specially crafted CTE SQL statement.

Note:

This is only exploitable if the default "examples" database connection is used, which allows access to both the examples schema and the metadata database.

Upgrade apache-superset to version 2.1.2 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Information Exposure. An authenticated attacker with read permissions on database connections metadata can access sensitive information such as the connection's username by exploiting this vulnerability.

Upgrade apache-superset to version 3.0.0 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Information Exposure such that by default, stack traces for errors are enabled, which results in the exposure of internal traces on REST API endpoints to users.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Preservation of Permissions. An improper default REST API permission for Gamma users allows for an authenticated Gamma user to test database connections.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Input Validation due to allowing SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could lead to unexpected file creation on Superset webservers.

Note:

If Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper REST API permission which allows authenticated Gamma users to test network connections.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to allowing an authenticated user to issue queries on database tables they may not have access to.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Incorrect Authorization due to allowing an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

Upgrade apache-superset to version 2.1.1 or higher.

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Access Restriction Bypass via import charts feature, allowing a non Admin authenticated user to incorrectly create resources.

Upgrade apache-superset to version 2.1.1 or higher.