CVE-2023-27524: Apache Superset's Authentication Bypass and RCE

PoC for CVE-2023-27524: Apache Superset's Authentication Bypass and RCE.

Apache Superset versions up to and including 2.0.1 are susceptible to a critical session validation vulnerability. Installations that have not modified the default SECRET_KEY configuration as per installation instructions are at risk. Attackers can exploit this vulnerability to authenticate and gain access to unauthorized resources. Superset administrators who have changed the default SECRET_KEY value are not affected by this vulnerability.

This video PoC was created for a CVE analysis www.vicarius.io/vsociety

Repo:https://github.com/jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

Скачать видео