Apache Superset Default SECRET_KEY Session Forgery

Product: Apache Superset
CVE: CVE-2023-27524
Disclosed: 2023-04-24
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Superset <= 2.0.1 with unchanged default SECRET_KEY
Fixed: 2.1.0 (refuses to start with default key)

Summary

Horizon3 found that roughly two-thirds of internet-facing Superset servers still used the default Flask SECRET_KEY. Knowing it, an attacker can forge an admin session cookie and then reach code execution through Superset features.

Root cause

Superset signs Flask session cookies with SECRET_KEY, and installations shipped with well-known defaults (e.g. '\x02\x01thisismyscretkey\x01\x02\\e\\y\\y\\h', 'CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET'). Signing a cookie with _user_id=1 yields admin access; Horizon3 then showed RCE via SQL Lab/database connections (e.g. SQLite/metadata DB abuse and pickled cache entries).

Impact

Unauthenticated admin takeover, credential theft from connected databases, and remote code execution.

Public PoC

flask-unsign --sign --cookie "{'_user_id': 1, 'user_id': 1}" \
  --secret '\x02\x01thisismyscretkey\x01\x02\e\y\y\h'

Source: Horizon3.ai

Detection

Use flask-unsign to test whether a session cookie verifies against known default keys; Horizon3 published a checker script.

Mitigation

Upgrade to 2.1+ and set a strong random SECRET_KEY, then rotate sessions.