CVE-2023-27524
Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:
SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>
Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Summary dbcve.org
Apache Superset versions up to and including 2.0.1 ship with a default SECRET_KEY that is publicly known, allowing attackers to forge signed session cookies and impersonate any user, including administrators, to access unauthorized resources. Because the SECRET_KEY is used to sign all session cookies and encrypt sensitive database information, an attacker who knows or recovers the default key can bypass authentication entirely.
Mitigation
Rotate the SECRET_KEY to a strong, cryptographically random value in superset_config.py (or set the SUPERSET_SECRET_KEY environment variable) and restart all Superset processes; existing sessions signed with the old key should be considered compromised and invalidated. Upgrading to a patched Superset release is also recommended for any additional hardening included beyond the key-rotation guidance.