CVE-2022-27479
📋 TL;DR
CVE-2022-27479 is a critical SQL injection vulnerability in Apache Superset that allows attackers to execute arbitrary SQL commands through chart data requests. This affects all Apache Superset instances before version 1.4.2. Attackers could potentially access, modify, or delete database information.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and database user privilege restrictions.
🎯 Exploit Status
Exploitation requires authenticated access to Superset. Public proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2 or higher
Vendor Advisory: https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
Restart Required: Yes
Instructions:
1. Backup your Superset instance and database. 2. Update Apache Superset to version 1.4.2 or later using pip: 'pip install --upgrade apache-superset==1.4.2'. 3. Run database migrations: 'superset db upgrade'. 4. Restart the Superset service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for chart data request parameters to block SQL injection patterns.
Implement WAF rules or application-level input validation for all chart-related endpoints
Database User Privilege Reduction
allLimit database user permissions to read-only for Superset application accounts.
ALTER USER superset_user WITH NOSUPERUSER NOCREATEDB NOCREATEROLE;
REVOKE ALL ON DATABASE superset_db FROM superset_user;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO superset_user;
🧯 If You Can't Patch
- Implement network segmentation to isolate Superset instances from critical databases
- Enable detailed SQL query logging and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check Superset version: if version is less than 1.4.2, the system is vulnerable.Check Version:
superset versionVerify Fix Applied:
Confirm Superset version is 1.4.2 or higher and test chart data requests with SQL injection payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs from Superset application user
- Multiple failed login attempts followed by chart data requests
- SQL syntax errors in application logs
Network Indicators:
- Unusual database connection patterns from Superset hosts
- Large data transfers from database to Superset instances
SIEM Query:
source="superset_logs" AND (message="*sql*" OR message="*query*") AND message="*error*"🔗 References
- http://www.openwall.com/lists/oss-security/2022/04/13/3
- https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
- https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
- http://www.openwall.com/lists/oss-security/2022/04/13/3
- https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
- https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
