CVE-2024-39887
📋 TL;DR
This SQL injection vulnerability in Apache Superset allows attackers to bypass SQL authorization by exploiting improperly sanitized PostgreSQL functions. It affects all Apache Superset installations before version 4.0.2. Attackers could potentially execute unauthorized SQL queries against the database.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion through unauthorized SQL execution
Likely Case
Unauthorized data access and potential privilege escalation within the database
If Mitigated
Limited impact with proper input validation and function restrictions in place
🎯 Exploit Status
Requires authenticated access to Superset interface; exploitation involves crafting specific SQL function calls
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2
Vendor Advisory: https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz
Restart Required: Yes
Instructions:
1. Backup your Superset instance and database. 2. Upgrade to Apache Superset 4.0.2 using pip: 'pip install apache-superset==4.0.2'. 3. Run database migrations: 'superset db upgrade'. 4. Restart the Superset service.
🔧 Temporary Workarounds
Configure DISALLOWED_SQL_FUNCTIONS
allAdd vulnerable PostgreSQL functions to the disallowed functions list in Superset configuration
Add to superset_config.py: DISALLOWED_SQL_FUNCTIONS = ['version', 'query_to_xml', 'inet_server_addr', 'inet_client_addr']
🧯 If You Can't Patch
- Implement network segmentation to restrict database access from Superset instances
- Apply strict input validation and SQL query monitoring at the database layer
🔍 How to Verify
Check if Vulnerable:
Check Superset version: 'superset version' or examine package version in Python environmentCheck Version:
superset versionVerify Fix Applied:
Confirm version is 4.0.2 or later and verify DISALLOWED_SQL_FUNCTIONS configuration includes vulnerable functions📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries containing version(), query_to_xml(), inet_server_addr(), or inet_client_addr() functions
- Multiple failed authorization attempts in Superset logs
Network Indicators:
- Unexpected database connections from Superset application servers
- Anomalous SQL query patterns to PostgreSQL
SIEM Query:
source="superset" AND ("version()" OR "query_to_xml" OR "inet_server_addr" OR "inet_client_addr")