[<prev] [next>] [day] [month] [year] [list]
Message-ID: <76a7b02a-0147-c007-5cbd-2365e76187dc@apache.org>
Date: Mon, 09 Dec 2024 12:14:05 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-53947: Apache Superset: Improper SQL authorisation, parse
not checking for specific postgres functions
Affected versions:
- Apache Superset before 4.1.0
Description:
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.
This issue affects Apache Superset: <4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
Credit:
Iván Arce (Quarkslab) (reporter)
Daniel Gaspar (remediation developer)
Mathieu Farrell (Quarkslab) (finder)
References:
https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-53947
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
