CVE-2023-27524
Apache Superset Insecure Default Initialization of Resource Vulnerability
Description
CVE-2023-27524 is a HIGH severity authentication bypass vulnerability in Apache Superset affecting all versions up to and including 2.0.1. The vulnerability stems from installations that retain the default SECRET_KEY shipped with the application, allowing attackers who know or can guess this key to forge valid session cookies and gain unauthorized access to the Superset instance. Apache Superset uses its SECRET_KEY to securely sign session cookies and encrypt sensitive database credentials, so the use of a predictable default value effectively invalidates all session security. This vulnerability was actively exploited and appears in CISA’s Known Exploited Vulnerabilities catalog. With an EPSS score of 84.1% placing it in the 99.3rd percentile, exploitation of CVE-2023-27524 is highly probable and public exploit code is available.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:LOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | superset | <= 2.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk(Mailing List, Vendor Advisory)
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.openwall.com/lists/oss-security/2023/04/24/2(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524(Third Party Advisory, US Government Resource)
Weakness Type
CWE-1188: Insecure Default Initialization of Resource
CWE-1188 describes a weakness where a product initializes or sets a resource such as a variable, data store, or connection with an insecure or predictable default value. In the case of CVE-2023-27524, Apache Superset ships with a known default SECRET_KEY that is publicly documented. Administrators who fail to change this value leave session signing mechanisms trivially bypassable, as any party aware of the default key can forge authenticated session tokens.
Learn more: CWE-1188 — Insecure Default Initialization of Resource
Impact Analysis
CVE-2023-27524 carries a CVSS 3.1 score of 8.9 (HIGH) and is remotely exploitable without physical access. The attack complexity is rated High, reflecting that knowledge of the default SECRET_KEY is required, but this information is publicly known from Apache Superset’s documentation and source code repositories, making this barrier minimal in practice. No authentication or user interaction is required. Scope (Changed): The vulnerability can affect resources and systems beyond the Superset component itself, as an attacker with admin-level session access can interact with connected databases, exfiltrate query results, and potentially pivot to backend systems. Confidentiality (High): Full read access to dashboards, datasets, and database credentials stored within Superset. Integrity (High): Attackers can modify configurations, create malicious content, or abuse Superset’s database connectivity for further attacks. With an EPSS score of 84.1%, active exploitation in the wild is highly likely.
Exploit Maturity
CVE-2023-27524 has a well-established and active exploit ecosystem. Public exploit code is available for CVE-2023-27524 via Packet Storm Security — Authentication Bypass and additionally a remote code execution exploit chain is documented at Packet Storm Security — Remote Code Execution. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of January 29, 2024. The EPSS score of 84.1% (99.3rd percentile) indicates near-certain ongoing exploitation activity in the broader threat landscape, making this a critical priority for any organization running an unpatched Apache Superset instance.
Remediation
- Change the SECRET_KEY immediately: Per the KEV required action, apply vendor mitigations immediately. Set a strong, unique, randomly generated SECRET_KEY in your file (e.g., ) or via the environment variable. This is the primary and most critical fix.
- Upgrade Apache Superset: Update to a version of Apache Superset beyond 2.0.1. Consult the official Apache Superset security advisories for the minimum safe version for your deployment.
- Invalidate existing sessions: After rotating the SECRET_KEY, all existing sessions signed with the old key are immediately invalidated. Force all users to re-authenticate to ensure no forged sessions remain active.
- Restrict network access: Apply network-level controls (firewalls, VPNs, IP allowlisting) to limit Superset access to authorized users only, reducing the attack surface for authentication bypass attempts.
- Audit access logs and connected databases: Review Superset access logs for anomalous login events or unauthorized activity. Rotate credentials for any databases connected to Superset, as attackers may have exfiltrated connection details during any period of unauthorized access.
Technical Details
CVE-2023-27524 exploits Apache Superset’s reliance on Flask’s session signing mechanism, which uses the application’s SECRET_KEY to create HMAC-signed session cookies. When a Superset installation retains the publicly documented default SECRET_KEY, any attacker can use Flask session manipulation tools to forge a valid administrator session cookie without any credentials. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L reflects that the attack originates over the network and requires no privileges or user interaction, with scope impacting systems beyond Superset itself. The weakness (CWE-1188) is a classic insecure default: the application ships with a predictable initialization value for a critical security parameter. Public exploit code is available via Packet Storm Security, demonstrating both authentication bypass and remote code execution exploitation paths leveraging this flaw.
Frequently Asked Questions
Is CVE-2023-27524 being actively exploited?
Yes. CISA confirmed active exploitation of CVE-2023-27524 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024. Public exploit code for both authentication bypass and remote code execution is available via Packet Storm Security. The EPSS score of 84.1% (99.3rd percentile) places this among the most actively exploited vulnerabilities.
What products are affected by CVE-2023-27524?
CVE-2023-27524 affects Apache Superset versions up to and including 2.0.1 where the default SECRET_KEY has not been changed from the shipped default value. Installations that have already configured a unique, secure SECRET_KEY per vendor installation instructions are not affected.
How do I fix CVE-2023-27524?
The primary fix is to set a strong, unique, randomly generated SECRET_KEY in your or via the environment variable. Additionally, upgrade Apache Superset to a version beyond 2.0.1 and invalidate all existing sessions by rotating the key. Audit database connections for potential credential exposure.
How severe is CVE-2023-27524?
CVE-2023-27524 is rated HIGH with a CVSS 3.1 score of 8.9. Its severity is amplified by the availability of public exploit code, confirmed active exploitation, and the fact that the exploitation prerequisite (knowing the default key) is trivially satisfied. The vulnerability allows full unauthorized administrative access to Superset and can impact connected backend databases.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.