Apache Superset - Elevation of Privilege
Date: 2023-11
Affected: pip/apache-superset
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-40610
CWE: CWE-863
CVSS: 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

### Overview An attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator. ### Details On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability). ### Proof of Concept Some tables are supposed to accept only SELECT requests from the SQL tab. - Attempt to create a new user injected_admin into the ab_user table: [PoC_1](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_1.png) But this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query. INSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax: WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘injected_admin@gmail.com’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a; [PoC_2](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_2.png) - injected_admin added to the ab_user table: [PoC_3](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_3.png) This method can also be used with UPDATE or DELETE request. A


Mitigations:

Architectural layers (MAESTRO):