Superset_auth_bypass_check

Apache-Superset authentication bypass vulnerability (CVE-2023-27524) detection tool

Fix date: 2023.8.3

• Fixed session invalidation caused by hardcoded session expiry time, introduced flask_session_cookie_manager tool to generate real-time sessions for detection.
• Fixed the bug where redirection was not disabled, causing a jump to /login/ and matching status code 200

Thanks to nplookges for the feedback

Development environment: python3

To avoid runtime failures due to python environment naming, you can change the python runtime to python3 and add it to environment variables

Usage (supports single URL and batch detection): //URLs are automatically normalized, supports input as ip, ip:port format

Single detection: python3 superset_auth_bypass_check.py -u

Example: python3 superset_auth_bypass_check.py -u http://192.168.1.1/

Batch detection: python3 superset_auth_bypass_check.py -f

Example: python3 superset_auth_bypass_check.py -f url.txt

Screenshot demonstration:

Single detection:

Batch detection:

Disclaimer

This tool is intended for educational and research purposes only, to enhance security awareness and improve software development practices. Before using this tool, please ensure that you comply with all applicable laws and ethical guidelines. After use, please delete this tool. The author is not responsible for any illegal attacks or other violations resulting from the use of this tool.