CVE-2023-27524: Apache Superset Insecure Default Initialization of Resource Vulnerability

Vulnerability summary

CVE-2023-27524 is a critical (CVSS 9.8) vulnerability in Apache Superset. It is known to be exploited: CISA lists it, first on 08-01-2024. EPSS estimates a 97.41% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 24-04-2023
   PublishedVulnerability first disclosed.
2. 08-01-2024
   Added to CISA KEVApache Superset Insecure Default Initialization of Resource Vulnerability
3. 29-01-2024
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

• CWE-1188Initialization of a Resource with an Insecure DefaultThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.