1 line
4.7 KiB
JSON
1 line
4.7 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-f678-j579-4xf5","published":"2023-11-28T18:56:21Z","modified":"2026-07-08T06:28:43.090611797Z","aliases":["BIT-superset-2023-40610","CVE-2023-40610","PYSEC-2026-1173"],"summary":"Apache Superset - Elevation of Privilege","details":"### Overview\nAn attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.\n\n### Details\nOn a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords.\nModification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. \"V7 - Insecure deserialization leading to remote code execution\" report vulnerability).\n\n### Proof of Concept\nSome tables are supposed to accept only SELECT requests from the SQL tab.\n- Attempt to create a new user injected_admin into the ab_user table: [PoC_1](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_1.png)\n\nBut this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query.\nINSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax:\n WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘injected_admin@gmail.com’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a;\n [PoC_2](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_2.png)\n - injected_admin added to the ab_user table: [PoC_3](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_3.png)\n\nThis method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables ab_user_role can escalate his privilege to become administrator.\n- Locating the ID of the user ‘Auditeur B’, who has no rights and is not an admin. The request is done being ‘Auditeur B’: [PoC_4](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_4.png)\n- Locating the rows that keep the role of the user ‘Auditeur B’. The row 36 stores the value 3, indicating the role ‘Alpha’ for ‘Auditeur B’: [PoC_5](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_5.png)\n- Modification of the row 36 with an UPDATE request embedded in a WITH request: [PoC_6](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_6.png)\n- ‘Auditeur B’ role has been changed to Admin: [PoC_7](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_7.png)\n\nThis technique can also be used to inject or modify values of the table key_value, which can potentially lead to a Remote Code Execution (cf. ...).\n\n### Solution\n#### Orange recommendation\nTo fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests.\n#### Security patch\nUpgrade to Superset version 2.1.2.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40610\nhttps://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot\n\n### Credits\nLEXFO for [Orange Innovation][orange]\n\n[Orange CERT-CC][ora] at [Orange group][orange]\n\n[ora]: <https://cert.orange.com/>\n[orange]: <https://www.orange.com/>\n\n### Timeline\n**Date reported:** July 27, 2023\n**Date fixed:** November 27, 2023","affected":[{"package":{"name":"apache-superset","ecosystem":"PyPI","purl":"pkg:pypi/apache-superset"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","2.0.0","2.0.1","2.1.0","2.1.1","2.1.1rc1","2.1.1rc2","2.1.1rc3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json"}}],"references":[{"type":"WEB","url":"https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40610"},{"type":"PACKAGE","url":"https://github.com/apache/superset"},{"type":"WEB","url":"https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/11/27/2"}],"database_specific":{"cwe_ids":["CWE-863"],"github_reviewed":true,"github_reviewed_at":"2023-11-28T18:56:21Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]} |