Apache Superset Session Validation Vulnerability Allowing Authentication Bypass

A session validation vulnerability has been identified in Apache Superset versions prior to and including 2.0.1. The issue arises in installations that have not changed the default SECRET_KEY, which is used to sign session cookies and encrypt sensitive database information. This vulnerability allows an attacker to authenticate and access unauthorized resources. However, it does not impact Superset administrators who have modified the SECRET_KEY as recommended. All Superset installations should set a unique, secure, random SECRET_KEY.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized access to resources. Furthermore, according to Packet Storm, this vulnerability can be exploited to achieve remote code execution.

Reproduction

To reproduce this vulnerability, log into an Apache Superset instance that is running a vulnerable version and has not changed the default SECRET_KEY. After logging in, the session cookie can be decoded to reveal the user ID. This ID can then be changed to that of an administrator and the cookie re-signed with the default SECRET_KEY. Once the forged cookie is accepted, access to the dashboard is granted. From there, a pickled Python payload can be uploaded to the dashboard, which will execute remotely.

Remediation

Users are advised to change the default SECRET_KEY to a unique, secure random value. This can be done by adding a strong SECRET_KEY to the superset_config.py file or by setting the SUPERSET_SECRET_KEY environment variable.