CVE-2024-53949
📋 TL;DR
Apache Superset has an improper authorization vulnerability when FAB_ADD_SECURITY_API is enabled (disabled by default). This allows lower-privilege users to access security API endpoints they shouldn't have permission to use. The vulnerability affects Apache Superset versions from 2.0.0 up to (but not including) 4.1.0.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Lower-privilege users could escalate privileges, modify security configurations, or access sensitive data they shouldn't have permission to view.
Likely Case
Users with limited permissions could perform unauthorized actions through the security API, potentially accessing or modifying resources beyond their intended scope.
If Mitigated
If FAB_ADD_SECURITY_API is disabled (default configuration), the vulnerability is not exposed. Proper network segmentation and access controls would limit the impact.
🎯 Exploit Status
Exploitation requires authenticated access with any user account and the FAB_ADD_SECURITY_API feature enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.0
Vendor Advisory: https://lists.apache.org/thread/d3scbwmfpzbpm6npnzdw5y4owtqqyq8d
Restart Required: Yes
Instructions:
1. Backup your Superset instance and database. 2. Upgrade Apache Superset to version 4.1.0 or later using your package manager or pip. 3. Restart the Superset service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable FAB_ADD_SECURITY_API
allSet FAB_ADD_SECURITY_API to False in Superset configuration to disable the vulnerable API endpoint.
Set FAB_ADD_SECURITY_API = False in superset_config.py
🧯 If You Can't Patch
- Disable FAB_ADD_SECURITY_API in configuration if enabled
- Implement strict network access controls and monitor for unusual API calls to security endpoints
🔍 How to Verify
Check if Vulnerable:
Check if running Apache Superset version between 2.0.0 and 4.1.0 (excluding 4.1.0) AND FAB_ADD_SECURITY_API is enabled in configuration.Check Version:
pip show apache-superset | grep VersionVerify Fix Applied:
Verify Apache Superset version is 4.1.0 or later, or confirm FAB_ADD_SECURITY_API is disabled.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /api/v1/security/* endpoints
- Unusual API calls from lower-privilege users to security-related endpoints
Network Indicators:
- HTTP requests to security API endpoints from users with insufficient privileges
SIEM Query:
source="superset" AND (uri_path="/api/v1/security/*" OR uri_path CONTAINS "/security/") AND user_role IN ("gamma", "alpha", "sql_lab")