CVE-2023-27524 is a high-severity vulnerability in Apache Superset [1] [2] [3] [4], an open-source data visualization software [1] [3]. This vulnerability allows remote code execution and has a CVSS score of 8.9.
Description
CVE-2023-27524 was first reported in April 2023 and is caused by a dangerous default configuration in Apache Superset [2]. It impacts versions up to 2.0.1. The vulnerability allows an unauthenticated attacker to gain remote code execution [2] [3], harvest credentials [1] [2] [3], and compromise data [1] [2] [3]. Although the specific details of the exploit are unknown, it is currently being actively exploited [2].
The US Cybersecurity and Infrastructure Security Agency (CISA) has recognized the severity of this vulnerability and added it, along with five other security flaws, to its Known Exploited Vulnerabilities catalog [2]. Federal Civilian Executive Branch agencies have been advised to apply fixes for these vulnerabilities by January 29, 2024 [2], in order to protect their networks from active threats [2].
Conclusion
The CVE-2023-27524 vulnerability in Apache Superset poses a significant risk to organizations using this software. It allows attackers to execute remote code, access unauthorized resources [4], and compromise sensitive data. The active exploitation of this vulnerability highlights the urgency for organizations to apply the necessary fixes and protect their networks. Failure to do so could result in severe consequences, including unauthorized access and data breaches. It is crucial for organizations to prioritize the mitigation of this vulnerability to ensure the security of their systems and data.
References
[1] https://owasp.or.id/2024/01/10/cisa-flags-6-vulnerabilities-apple-apache-adobe-d-link-joomla-under-attack/
[2] https://thehackernews.com/2024/01/cisa-flags-6-vulnerabilities-apple.html
[3] https://cert.bournemouth.ac.uk/cisa-flags-6-vulnerabilities-apple-apache-adobe-d-link-joomla-under-attack/
[4] https://www.redpacketsecurity.com/cisa-warns-agencies-of-fourth-flaw-used-in-triangulation-spyware-attacks/
