CVE-2023-49657
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in Apache Superset allows authenticated attackers with create/update permissions to inject malicious scripts into charts or dashboards. When other users view these compromised elements, the attacker's scripts execute in their browser context. This affects all Apache Superset instances before version 3.0.3.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts and data.
Likely Case
Attackers with legitimate permissions abuse their access to inject scripts that steal session tokens or perform unauthorized actions on behalf of other users.
If Mitigated
With proper Content Security Policy (CSP) configurations and input validation, script execution would be blocked, limiting impact to potential data corruption.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once permissions are obtained. Stored XSS payloads persist until removed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx
Restart Required: Yes
Instructions:
1. Upgrade Apache Superset to version 3.0.3 or later. 2. Restart the Superset service. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Implement Content Security Policy for 2.X versions
allAdd the provided TALISMAN_CONFIG to your Superset configuration to restrict script execution
Add the TALISMAN_CONFIG dictionary to your superset_config.py file
🧯 If You Can't Patch
- Restrict user permissions to minimize who can create/update charts and dashboards
- Implement web application firewall (WAF) rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check your Apache Superset version. If it's below 3.0.3, you are vulnerable.Check Version:
superset versionVerify Fix Applied:
Verify version is 3.0.3 or higher and test that script injection in chart/dashboard fields is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual chart/dashboard creation/modification patterns
- JavaScript or HTML snippets in chart/dashboard metadata fields
Network Indicators:
- Unexpected outbound connections from Superset user sessions
- Suspicious script loading in HTTP responses
SIEM Query:
source="superset" AND (event="chart_create" OR event="dashboard_update") AND (payload CONTAINS "<script>" OR payload CONTAINS "javascript:")