pentester.land· Sep 6, 2023· by Naveen Sunkavally

Apache Superset Part II: RCE, Credential Harvesting and More

Target Program: Apache Superset

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#RCE#Insecure deserialization#URL validation bypass#Broken authorization#Arbitrary file read#Insufficiently Protected Credentials#Default Flask Secret Key#Hardcoded credentials

Apache Superset Part II: RCE, Credential Harvesting and More

More Writeups Like This

Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360

CVE-2023-27524: Insecure Default Configuration in Apache Superset Leads to Remote Code Execution

Multiple vulnerabilities in H2O ≤ 3.32.1.3

Riding The Inforail To Exploit Ivanti Avalanche Part 2