CVE-2024-34693
📋 TL;DR
This vulnerability allows authenticated attackers in Apache Superset to create MariaDB connections with local_infile enabled, potentially reading arbitrary files from the web server if both MariaDB server and client configurations permit it. It affects Apache Superset versions before 3.1.3 and version 4.0.0. Attackers could exfiltrate sensitive server files through database operations.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attacker reads sensitive files (config files, credentials, private keys) from the web server and exfiltrates them via database insertion, potentially leading to full system compromise.
Likely Case
Authenticated attacker with database connection privileges reads accessible files from the web server, potentially exposing configuration data or other sensitive information.
If Mitigated
With proper input validation and secure configurations, file read attempts are blocked and logged.
🎯 Exploit Status
Requires authenticated access to Superset, ability to create MariaDB connections, and specific database configurations. The vulnerability details are publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.1 or 3.1.3
Vendor Advisory: https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon
Restart Required: Yes
Instructions:
1. Backup your Superset instance and database. 2. Upgrade to Apache Superset 4.0.1 or 3.1.3 using pip: 'pip install apache-superset==4.0.1' or 'pip install apache-superset==3.1.3'. 3. Run 'superset db upgrade'. 4. Restart the Superset service.
🔧 Temporary Workarounds
Disable local_infile on MariaDB servers
allConfigure MariaDB servers to disable local_infile functionality
Add 'local-infile=0' to MariaDB server configuration file (my.cnf or my.ini) under [mysqld] section
Restrict database connection privileges
allLimit which users can create MariaDB connections in Superset
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Superset instances from sensitive file systems
- Enable detailed logging of database connection attempts and file access patterns for monitoring
🔍 How to Verify
Check if Vulnerable:
Check Superset version: 'superset version' or examine package version. If version is <3.1.3 or exactly 4.0.0, you are vulnerable.Check Version:
superset versionVerify Fix Applied:
After upgrade, verify version is 3.1.3 or 4.0.1 or higher using 'superset version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual MariaDB connection attempts with local_infile parameter
- SQL queries containing LOAD DATA LOCAL INFILE commands from Superset users
- Multiple file read attempts via database operations
Network Indicators:
- Unexpected outbound connections from Superset server to MariaDB with file transfer patterns
SIEM Query:
source="superset.logs" AND ("local_infile" OR "LOAD DATA LOCAL")