h1n4mx0z/research-cve-2023-27524CVE-2023-27524
The ASEAN Information Security Student Competition (Jeopardy) has temporarily concluded; my team MSEC_HUNT3R won second place in the Jeopardy bracket. I feel both happy and sad because this year's web challenge didn't meet my expectations, but anyway, I have a CVE to analyze :v
CVE-2023-27524 was discovered in Apache Superset with a CVSS score of 8.9 in 2021, but the CVE was not published until 2023. It is an open-source data exploration and visualization tool. Affected versions from 1.4.1 to 2.0.1, the issue occurs when the admin runs Apache with default configuration, resulting in these servers being like a house without a door because everyone has a key. This allows an attacker to "log in" with admin privileges and even sleep on your wife's bed without anyone noticing :)) In this article, I will dive deep into the default configuration of this issue. This analysis is based on this.
Superset is written using Python's Flask library and uses SECRET_KEY for user authentication. It is a common practice for Flask-based applications to use cryptographically signed session cookies to manage user state. When a user logs in, the web application sends a session cookie containing the user identifier back to the end user's browser. The web application then signs it with SECRET_KEY, a randomly generated value stored in a local configuration file. Each time a request is made, the browser sends the current session cookie to the web application, and the web application authenticates the user based on the signature in the cookie before processing the request.
