Listen to this Post
How the CVE Works
The vulnerability in Apache Superset arises when a guest user requests chart data via the `/chart/data` endpoint. The API response inadvertently includes the underlying database query in the payload, exposing sensitive schema details like table names. This occurs due to insufficient access controls in versions prior to 4.1.3, allowing low-privileged users to view metadata that should be restricted.
DailyCVE Form
Platform: Apache Superset
Version: < 4.1.3
Vulnerability: Information disclosure
Severity: Moderate
Date: Aug 14, 2025
Prediction: Patch expected Aug 21, 2025
What Undercode Say
Analytics
SELECT query FROM chart_data WHERE user_role = 'guest';
import requests
response = requests.get('/chart/data', params={'chart_id': '123'});
print(response.json()['query'])
How Exploit
1. Authenticate as guest.
2. Fetch `/chart/data` endpoint.
3. Extract schema details from `query` field.
Protection from this CVE
- Upgrade to v4.1.3.
- Restrict `/chart/data` responses.
- Audit guest permissions.
Impact
- Unauthorized schema access.
- Potential data enumeration.
- Metadata leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
