PoC for CVE-2023-27524: Apache Superset's Authentication Bypass and RCE.
Apache Superset versions up to and including 2.0.1 are susceptible to a critical session validation vulnerability. Installations that have not modified the default SECRET_KEY configuration as per installation instructions are at risk. Attackers can exploit this vulnerability to authenticate and gain access to unauthorized resources. Superset administrators who have changed the default SECRET_KEY value are not affected by this vulnerability.
This video PoC was created for a CVE analysis
www.vicarius.io/vsociety
Repo:
https://github.com/jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE