Shulou(Shulou.com)06/01 Report--

How to carry out Apache Superset remote code execution vulnerabilities, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain for you in detail, people with this need can come to learn, I hope you can gain something.

Brief introduction of 0x01 vulnerability

On September 19, 2020, 360CERT Monitoring found that the Apache email Group issued a risk notice for a vulnerability in superset code execution, the vulnerability number is CVE-2020-13948, vulnerability level: high risk, vulnerability score: 7.2.

An authenticated remote attacker can have an impact on remote code execution by sending a specially crafted request packet.

In this regard, 360CERT recommends that the majority of users upgrade superset to the latest version in time. At the same time, please do a good job of asset self-examination and prevention to avoid hacker attacks.

0x02 risk rating

360CERT's assessment of the vulnerability is as follows

Assessment methods, threat levels, high risk impact surfaces, limited 360CERT scores, 7.20x03 vulnerability details CVE-2020-13948: code execution vulnerabilities

Apache Superset is an open source software developed by Airbnb for data exploration and data visualization, which can handle large amounts of data. Can quickly create data report / data large screen through click operation.

A logic vulnerability exists in Apache Superset that allows access to python os packages when its template engine processes special content, resulting in arbitrary code execution.

An authenticated remote attacker can have an impact on remote code execution by sending a specially crafted request packet.

0x04 affects version

-apache:superset:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.