CVE-2023-36388 : Security Advisory and Response

Apache Superset: Improper API permission for low privilege users allows for SSRF

Understanding CVE-2023-36388

This CVE involves an improper REST API permission issue in Apache Superset that allows authenticated Gamma users to test network connections, leading to a possible Server-Side Request Forgery (SSRF) vulnerability.

What is CVE-2023-36388?

The CVE-2023-36388 vulnerability in Apache Superset up to and including version 2.1.0 allows low privilege users to test network connections, potentially leading to SSRF attacks.

The Impact of CVE-2023-36388

The impact of CVE-2023-36388 is rated as MEDIUM severity with a CVSS base score of 4.3. Attackers could exploit this vulnerability to perform SSRF attacks, compromising the security and integrity of the system.

Technical Details of CVE-2023-36388

This section provides insights into the specific technical aspects of the CVE.

Vulnerability Description

The vulnerability stems from the improper REST API permission settings in Apache Superset, enabling authenticated Gamma users to test network connections and potentially trigger SSRF attacks.

Affected Systems and Versions

Apache Superset versions up to and including 2.1.0 are affected by this vulnerability, exposing systems to SSRF risks.

Exploitation Mechanism

Attackers with low privilege access can exploit the improper API permission to test network connections and launch SSRF attacks, potentially gaining unauthorized access to sensitive data.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-36388, immediate actions and long-term security practices are crucial.

Immediate Steps to Take

Update Apache Superset to version 2.1.1 or later to patch the vulnerability.
Monitor network connections and investigate any suspicious activity that could indicate SSRF attempts.

Long-Term Security Practices

Implement least privilege access controls to restrict user capabilities and reduce the attack surface.
Regularly audit and review API permissions to ensure proper configurations and prevent similar vulnerabilities.

Patching and Updates

Stay informed about security updates released by Apache Software Foundation for Apache Superset. Timely patch application is essential to address vulnerabilities and enhance system security.