CVE-2022-27479: Apache Superset SQLi Vulnerability

CVE-2022-27479 Overview

CVE-2022-27479 is a SQL injection vulnerability in Apache Superset versions prior to 1.4.2. The flaw resides in the handling of chart data requests, where user-supplied input reaches the underlying database query layer without sufficient sanitization. Apache Superset is a widely deployed open-source data exploration and visualization platform, which broadens the exposure of this defect across analytics infrastructure.

The vulnerability is categorized under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation allows attackers to manipulate backend SQL queries, potentially exposing or modifying sensitive analytical data. The Apache Software Foundation addressed the issue in Superset 1.4.2.

Critical Impact
Unauthenticated network-based SQL injection in Apache Superset chart data requests can lead to disclosure, modification, or destruction of data stored in connected databases.

Affected Products

Apache Superset versions before 1.4.2
Deployments exposing the chart data API to untrusted networks
Self-hosted Superset instances integrated with backend analytical databases

Discovery Timeline

2022-04-13 - CVE-2022-27479 published to NVD
2022-04-13 - Public disclosure via Openwall OSS Security Discussion
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-27479

Vulnerability Analysis

The vulnerability stems from insufficient input validation in the chart data request handling path of Apache Superset. Parameters submitted as part of chart data API calls are incorporated into SQL queries executed against connected datasources. Because user input is not adequately neutralized, attackers can inject SQL syntax that the backend database engine interprets as part of the intended query.

Apache Superset routinely connects to production analytical databases containing business-critical data. A successful injection therefore compromises confidentiality, integrity, and availability of those data stores. The defect is reachable over the network, requires no authentication context guarantees, and needs no user interaction, which increases the practical risk for internet-exposed deployments.

The Exploit Prediction Scoring System assigns this CVE a probability in the upper percentile range, reflecting active interest in publicly disclosed Superset issues. While no public proof-of-concept is referenced in the available sources, the technical class of the flaw is well-understood and historically targeted by automated scanners.

Root Cause

The root cause is improper neutralization of special characters within parameters consumed by Superset's chart data request endpoint. Query construction concatenates or interpolates untrusted values into SQL statements rather than relying exclusively on parameterized queries or strict allowlists. This pattern matches [CWE-89] and was corrected in the 1.4.2 release.

Attack Vector

An attacker submits crafted HTTP requests to the Superset chart data API containing SQL metacharacters in vulnerable fields. The injected fragments alter the structure of generated queries when executed against the configured datasource. Depending on the privileges of the database account Superset uses, attackers can read arbitrary tables, modify records, or in some configurations chain the access to broader compromise of the data platform.

The vulnerability mechanism is described in the upstream Apache Mailing List Thread and a related Apache Mailing List Thread. No verified exploit code is published in the referenced sources.

Detection Methods for CVE-2022-27479

Indicators of Compromise

HTTP requests to Superset chart data endpoints containing SQL metacharacters such as single quotes, UNION SELECT, comment sequences (--, /* */), or stacked statement separators
Unexpected query patterns or errors in the database logs of datasources connected to Superset
New or modified administrative records in tables exposed through Superset datasources
Outbound connections from the Superset host to attacker-controlled infrastructure following anomalous API traffic

Detection Strategies

Inspect Superset application logs for malformed or oversized parameters delivered to chart data routes
Correlate web access logs with database query logs to identify injected SQL originating from Superset
Deploy a web application firewall ruleset tuned for SQL injection patterns in front of Superset
Audit Superset's configured database service accounts for queries outside expected analytical workloads

Monitoring Recommendations

Forward Superset, reverse-proxy, and backend database logs to a centralized analytics platform for correlation
Alert on authentication anomalies and bursts of failed chart data requests that may indicate probing
Track Superset version inventory across environments and flag instances below 1.4.2

How to Mitigate CVE-2022-27479

Immediate Actions Required

Upgrade Apache Superset to version 1.4.2 or later on every deployment
Restrict network access to Superset using authenticated reverse proxies or VPN gating until the patch is applied
Rotate credentials for database accounts used by Superset if exploitation is suspected
Review Superset audit logs and connected database query history for indications of injection attempts

Patch Information

The Apache Superset project released version 1.4.2 to remediate this issue. Administrators should follow the upstream upgrade documentation and verify the running version after deployment. Release coordination is documented in the Apache Mailing List Thread.

Workarounds

Place Superset behind a web application firewall with SQL injection signatures enabled if immediate patching is not possible
Limit the privileges of database accounts configured as Superset datasources to read-only roles where feasible
Disable or restrict access to chart data API endpoints for unauthenticated or low-trust user roles

bash

# Verify the installed Superset version
superset version

# Upgrade Superset using pip
pip install --upgrade "apache-superset>=1.4.2"

# Restart the Superset services after upgrade
systemctl restart superset