Listen to this Post
How the CVE Works
Apache Superset uses a denylist (DISALLOWED_SQL_FUNCTIONS) to block dangerous SQL functions. However, an attacker can bypass this restriction by injecting a specially crafted inline block in SQL Lab. This manipulation tricks the system into executing blocked functions, such as version(), exposing sensitive database metadata. The vulnerability stems from insufficient input validation when processing inline SQL blocks, allowing unauthorized function execution despite the denylist.
DailyCVE Form
Platform: Apache Superset
Version: < 5.0.0
Vulnerability: SQL function bypass
Severity: Moderate
Date: Aug 14, 2025
Prediction: Patch expected Aug 25, 2025
What Undercode Say
-- Exploitable SQL snippet in Superset SQL Lab
SELECT { / malicious inline block / version() } AS db_version;
Check Superset version for vulnerability curl -I http://superset-server/info | grep "X-Superset-Version"
How Exploit
- Attacker crafts inline SQL block in SQL Lab.
- Bypasses `DISALLOWED_SQL_FUNCTIONS` denylist.
- Executes blocked functions (e.g.,
version()).
Protection from this CVE
- Upgrade to Superset 5.0.0.
- Restrict SQL Lab access.
- Audit inline SQL blocks.
Impact
- Sensitive database info leak.
- Unauthorized function execution.
- Metadata exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
