From 174088b3201eadab76b7cce8b50c811389055567 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 10 Jan 2024 19:17:48 +0000 Subject: [PATCH] Publish Advisories GHSA-392c-vjfv-h7wr GHSA-f678-j579-4xf5 --- .../2023/11/GHSA-392c-vjfv-h7wr/GHSA-392c-vjfv-h7wr.json | 9 +++++---- .../2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json | 4 ++-- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2023/11/GHSA-392c-vjfv-h7wr/GHSA-392c-vjfv-h7wr.json b/advisories/github-reviewed/2023/11/GHSA-392c-vjfv-h7wr/GHSA-392c-vjfv-h7wr.json index e40ae71b595..891717ccad4 100644 --- a/advisories/github-reviewed/2023/11/GHSA-392c-vjfv-h7wr/GHSA-392c-vjfv-h7wr.json +++ b/advisories/github-reviewed/2023/11/GHSA-392c-vjfv-h7wr/GHSA-392c-vjfv-h7wr.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-392c-vjfv-h7wr", - "modified": "2024-01-10T19:08:04Z", + "modified": "2024-01-10T19:16:30Z", "published": "2023-11-27T12:30:55Z", + "withdrawn": "2024-01-10T19:16:30Z", "aliases": [ - "CVE-2023-40610" + ], - "summary": "Apache Superset - Elevation of Privilege", - "details": "Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.\n\n", + "summary": "Duplicate Advisory: Apache Superset - Elevation of Privilege", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-ID]. This link is maintained to preserve external references.\n\n### Original Description\n\nImproper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.\n\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json b/advisories/github-reviewed/2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json index c009f8c622c..442ad82eb15 100644 --- a/advisories/github-reviewed/2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json +++ b/advisories/github-reviewed/2023/11/GHSA-f678-j579-4xf5/GHSA-f678-j579-4xf5.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-f678-j579-4xf5", - "modified": "2023-11-28T18:56:21Z", + "modified": "2024-01-10T19:17:04Z", "published": "2023-11-28T18:56:21Z", "aliases": [ - + "CVE-2023-40610" ], "summary": "Apache Superset - Elevation of Privilege", "details": "### Overview\nAn attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.\n\n### Details\nOn a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords.\nModification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. \"V7 - Insecure deserialization leading to remote code execution\" report vulnerability).\n\n### Proof of Concept\nSome tables are supposed to accept only SELECT requests from the SQL tab.\n- Attempt to create a new user injected_admin into the ab_user table: [PoC_1](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_1.png)\n\nBut this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query.\nINSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax:\n WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘injected_admin@gmail.com’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a;\n [PoC_2](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_2.png)\n - injected_admin added to the ab_user table: [PoC_3](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_3.png)\n\nThis method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables ab_user_role can escalate his privilege to become administrator.\n- Locating the ID of the user ‘Auditeur B’, who has no rights and is not an admin. The request is done being ‘Auditeur B’: [PoC_4](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_4.png)\n- Locating the rows that keep the role of the user ‘Auditeur B’. The row 36 stores the value 3, indicating the role ‘Alpha’ for ‘Auditeur B’: [PoC_5](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_5.png)\n- Modification of the row 36 with an UPDATE request embedded in a WITH request: [PoC_6](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_6.png)\n- ‘Auditeur B’ role has been changed to Admin: [PoC_7](https://github.com/orangecertcc/security-research/blob/main/CVE-2023-40610/PoC_7.png)\n\nThis technique can also be used to inject or modify values of the table key_value, which can potentially lead to a Remote Code Execution (cf. ...).\n\n### Solution\n#### Orange recommendation\nTo fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests.\n#### Security patch\nUpgrade to Superset version 2.1.2.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40610\nhttps://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot\n\n### Credits\nLEXFO for [Orange Innovation][orange]\n\n[Orange CERT-CC][ora] at [Orange group][orange]\n\n[ora]: \n[orange]: \n\n### Timeline\n**Date reported:** July 27, 2023\n**Date fixed:** November 27, 2023",