CVE-2023-49734
📋 TL;DR
This vulnerability allows authenticated Gamma users in Apache Superset to gain unauthorized write permissions to charts they create on dashboards. The flaw enables privilege escalation where users can modify charts they shouldn't have write access to. This affects Apache Superset versions before 2.1.2 and versions 3.0.0 through 3.0.1.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Gamma users could modify or delete critical business intelligence charts, potentially altering data visualizations that inform business decisions or injecting malicious content.
Likely Case
Gamma users unintentionally or intentionally modify charts they created but shouldn't have ongoing write access to, causing data integrity issues.
If Mitigated
With proper access controls and monitoring, impact is limited to minor data visualization inconsistencies that can be audited and corrected.
🎯 Exploit Status
Exploitation requires authenticated Gamma user access; the vulnerability is inherent to the permission logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.3 or 3.0.2
Vendor Advisory: https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5
Restart Required: Yes
Instructions:
1. Backup your Superset instance. 2. Upgrade to Apache Superset 2.1.3 or 3.0.2 using pip: 'pip install apache-superset==3.0.2'. 3. Run database migrations: 'superset db upgrade'. 4. Restart the Superset service.
🔧 Temporary Workarounds
Restrict Gamma User Dashboard Creation
allTemporarily remove dashboard creation permissions from Gamma role users
superset init
Edit roles in Superset UI to remove 'can_write on Dashboard' from Gamma role
🧯 If You Can't Patch
- Implement strict access controls to limit Gamma users' dashboard creation capabilities
- Enable detailed audit logging for all chart modification activities and monitor for unauthorized changes
🔍 How to Verify
Check if Vulnerable:
Check Superset version: if version is <2.1.2 or between 3.0.0-3.0.1, system is vulnerableCheck Version:
superset versionVerify Fix Applied:
After upgrade, verify version is 2.1.3 or 3.0.2+ and test that Gamma users cannot retain write permissions on charts they create📡 Detection & Monitoring
Log Indicators:
- Unauthorized chart modification events by Gamma users
- Dashboard permission changes for Gamma role
Network Indicators:
- API calls to modify charts from Gamma-privileged accounts
SIEM Query:
source="superset" action="save" user.role="Gamma" chart_id=*