CVE-2024-39887

MEDIUM NUCLEI

Apache Superset < 4.0.2 - SQL Injection via PostgreSQL Engine-Specific Functions

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-39887 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue.

Nuclei Templates (1)

Apache Superset < 4.0.2 - SQL Injection
MEDIUMVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: http.favicon.hash:"1582430156" || http.html:"apache superset"
FOFA: body="apache superset" || icon_hash=1582430156

References (2)

Core 2
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/16/5
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz

Scores

CVSS v3 4.3
EPSS 0.5572
EPSS Percentile 98.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
apache/superset < 4.0.2
pypi/apache-superset 0 - 4.0.2PyPI
Published Jul 16, 2024
Tracked Since Feb 18, 2026