Apache Superset DISALLOWED_SQL_FUNCTIONS Bypass Vulnerability Allowing Execution of Blocked SQL Functions

A vulnerability in Apache Superset prior to version 5.0.0 allows for a bypass of the DISALLOWED_SQL_FUNCTIONS security feature. This flaw enables users with SQL Lab access to execute SQL functions that were meant to be disabled. The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive database information, such as the software version.

Impact

Exploitation of this vulnerability could result in the unauthorized execution of blocked SQL functions, allowing access to sensitive database information, including the software version.

Remediation

Users are advised to upgrade to Apache Superset version 5.0.0 or later, which addresses this vulnerability.