CVE-2023-40610: Apache Superset Privilege Escalation Flaw

CVE-2023-40610 Overview

CVE-2023-40610 is an improper authorization vulnerability [CWE-863] in Apache Superset versions prior to 2.1.2. The flaw resides in the default examples database connection, which grants access to both the examples schema and the Superset metadata database. An authenticated attacker can submit a crafted Common Table Expression (CTE) SQL statement to read or modify rows in the metadata database. Successful exploitation enables tampering with authentication and authorization data, leading to privilege escalation across the Superset deployment.

Critical Impact
Authenticated users with access to the default examples database can manipulate Superset's metadata tables, modify role and permission records, and escalate privileges to administrative access.

Affected Products

Apache Superset versions up to but excluding 2.1.2
Deployments using the default examples database connection
Self-hosted and managed Superset instances exposing SQL Lab to non-admin users

Discovery Timeline

2023-11-27 - CVE-2023-40610 published to NVD
2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-40610

Vulnerability Analysis

Apache Superset ships with a preconfigured examples database used to load sample dashboards. In affected versions, this connection points to the same backend that stores Superset's own metadata, including the ab_user, ab_role, and ab_permission_view tables managed by Flask-AppBuilder. Authorization checks in SQL Lab focus on the declared target schema and do not fully evaluate cross-schema references constructed inside a Common Table Expression. An attacker with permission to query the examples database can therefore craft a CTE that pivots from the examples schema into the metadata schema and issues read or write operations.

The authorization weakness is classified as [CWE-863] Incorrect Authorization. Because the metadata database stores credentials, role assignments, and access control entries, modification of these rows produces persistent privilege escalation that survives session boundaries.

Root Cause

The root cause is the combination of an over-privileged default database connection and an authorization check that does not parse CTE structures before deciding whether a statement targets a permitted schema. The examples database connection holds credentials that the Superset application itself uses, so any query routed through it inherits application-level write privileges on the metadata tables.

Attack Vector

The vector is network-accessible and requires low privileges. An attacker authenticates to Superset with any account permitted to use SQL Lab against the examples database. The attacker then issues a SQL statement built around a CTE that references metadata tables and performs INSERT, UPDATE, or DELETE operations against ab_user, ab_user_role, or related tables. Manipulating these rows grants the attacker administrative roles or resets credentials for existing administrators. See the GitHub Security Advisory GHSA-f678-j579-4xf5 for additional technical context.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2023-40610

Indicators of Compromise

SQL Lab query logs containing WITH clauses that reference Flask-AppBuilder tables such as ab_user, ab_role, ab_permission_view, or ab_user_role
Unexpected INSERT or UPDATE statements executed against the metadata database from the examples connection
New administrator role assignments or password hash changes that do not correlate with administrative UI activity
Login events from accounts whose role membership changed without an audit trail entry

Detection Strategies

Enable query logging in Superset and alert on any SQL Lab query that references ab_ prefixed tables from a non-admin user
Compare the current ab_user_role and ab_permission_view table contents against a known-good baseline on a recurring schedule
Inspect database server audit logs for write operations originating from the credentials assigned to the Superset examples connection

Monitoring Recommendations

Forward Superset application logs and metadata database audit logs to a centralized analytics platform for correlation
Alert on changes to role-to-user mappings and on creation of new accounts with the Admin role outside of change windows
Monitor for SQL Lab usage spikes against the examples database, particularly queries containing recursive or chained CTEs

How to Mitigate CVE-2023-40610

Immediate Actions Required

Upgrade Apache Superset to version 2.1.2 or later, where the authorization check accounts for CTE references
Remove or disable the default examples database connection if it is not required for production use
Rotate the database credentials used by the examples connection and restrict their grants to read-only access on the examples schema
Audit ab_user, ab_role, and ab_user_role tables for unauthorized modifications and revert unexpected changes

Patch Information

Apache fixed the issue in Superset 2.1.2. Refer to the Apache Mailing List Discussion and the Openwall OSS Security advisory for the official remediation guidance. Operators running affected versions should upgrade and then verify that the examples connection no longer permits writes to the metadata schema.

Workarounds

Delete the examples database connection from the Superset admin UI and remove sample dashboards that depend on it
Configure a dedicated database user for the examples connection with privileges scoped only to the examples schema
Restrict SQL Lab access through role permissions so that only trusted analysts can issue ad hoc queries
Place the Superset metadata database on a separate database server from any user-accessible data sources

bash

# Configuration example: restrict the examples database role in PostgreSQL
REVOKE ALL ON ALL TABLES IN SCHEMA public FROM superset_examples;
GRANT USAGE ON SCHEMA examples TO superset_examples;
GRANT SELECT ON ALL TABLES IN SCHEMA examples TO superset_examples;