CVE-2024-34693: Apache Superset SQLi Vulnerability

CVE-2024-34693 Overview

CVE-2024-34693 is an Improper Input Validation vulnerability in Apache Superset that allows an authenticated attacker to create a MariaDB connection with local_infile enabled. When both the MariaDB server (which has this feature disabled by default) and the local MySQL client on the web server are configured to allow local infile operations, an attacker can execute specific MySQL/MariaDB SQL commands capable of reading files from the server and inserting their content into a MariaDB database table.

This vulnerability represents a significant security concern for organizations using Apache Superset with MariaDB backends, as it could lead to unauthorized access to sensitive server files through a legitimate database connection interface.

Critical Impact

Authenticated attackers can potentially read arbitrary files from the Apache Superset server and exfiltrate sensitive data through MariaDB database operations when specific server configurations are in place.

Affected Products

• Apache Superset versions before 3.1.3
• Apache Superset version 4.0.0
• Apache Superset deployments with MariaDB database connections

Discovery Timeline

• June 20, 2024 - CVE-2024-34693 published to NVD
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2024-34693

Vulnerability Analysis

This vulnerability stems from improper input validation in Apache Superset's database connection handling. When creating database connections to MariaDB, Superset fails to adequately validate and restrict the local_infile parameter. This MySQL/MariaDB feature, when enabled, allows the LOAD DATA LOCAL INFILE SQL statement to read files from the client machine (in this case, the Superset web server) and load them into database tables.

The attack requires authentication to the Apache Superset instance, meaning an attacker must have valid credentials. However, once authenticated, the attacker can configure a MariaDB connection that enables local file reading capabilities. The vulnerability exploits the trust relationship between the Superset server and the MariaDB database, using the database connection as a conduit for file exfiltration.

The successful exploitation depends on a specific configuration where both the MariaDB server has local_infile enabled (off by default) and the MySQL client library on the Superset web server is also configured to allow local infile operations.

Root Cause

The root cause of CVE-2024-34693 is insufficient validation of database connection parameters in Apache Superset. The application does not properly sanitize or restrict the local_infile setting when users create MariaDB database connections. This allows authenticated users to enable a potentially dangerous feature that should be controlled by administrators only.

The vulnerability is classified under CWE-20 (Improper Input Validation), as the application fails to validate that the connection parameters conform to secure configuration requirements.

Attack Vector

The attack is network-based and requires authentication to the Apache Superset application. The attacker must:

1. Authenticate to a vulnerable Apache Superset instance
2. Create a new MariaDB database connection with local_infile enabled
3. Execute LOAD DATA LOCAL INFILE SQL commands to read files from the Superset server
4. Store the file contents in a MariaDB table accessible to the attacker

The attack exploits the web application's database connection functionality to achieve file system access on the underlying server. The vulnerability allows reading files that the Superset web server process has permission to access, potentially including configuration files, credentials, application source code, or other sensitive data.

Detection Methods for CVE-2024-34693

Indicators of Compromise

• Unusual MariaDB database connections created with local_infile enabled
• SQL query logs showing LOAD DATA LOCAL INFILE statements executed through Superset
• Database tables containing file content that appears to be configuration files or system data
• Unexpected file access patterns on the Superset server matching database query timestamps

Detection Strategies

• Monitor Apache Superset database connection configurations for local_infile parameter usage
• Implement SQL query logging and alerting for LOAD DATA LOCAL INFILE commands
• Review audit logs for database connection creation activities, especially from non-administrative users
• Deploy network monitoring to detect unusual data transfers between Superset servers and MariaDB instances

Monitoring Recommendations

• Enable comprehensive audit logging for Apache Superset database connection management
• Configure MariaDB general query logs to capture all SQL statements for forensic analysis
• Implement file integrity monitoring on the Superset server to detect unauthorized file access attempts
• Set up alerts for new database connections with non-standard configuration parameters

How to Mitigate CVE-2024-34693

Immediate Actions Required

• Upgrade Apache Superset to version 4.0.1 or 3.1.3 immediately
• Review all existing MariaDB database connections in Superset for local_infile configurations
• Ensure MariaDB server configuration has local_infile=0 set globally
• Audit user permissions and restrict database connection creation to trusted administrators

Patch Information

Apache recommends upgrading to Apache Superset version 4.0.1 or 3.1.3, which address this vulnerability by implementing proper input validation for database connection parameters. The patches prevent users from enabling local_infile through the Superset interface, regardless of the underlying database server configuration.

For additional security information and discussion, refer to the Apache Security Thread Discussion and the Openwall OSS Security Update.

Workarounds

• Disable local_infile on the MariaDB server by setting local_infile=0 in the server configuration
• Configure the MySQL client library on the Superset server to disable local infile by default
• Implement network segmentation to restrict Superset server access to sensitive file locations
• Apply strict user access controls to limit which users can create or modify database connections in Superset

# MariaDB server configuration to disable local_infile
# Add to my.cnf or mariadb.cnf [mysqld] section
[mysqld]
local_infile=0

# Restart MariaDB service after configuration change
sudo systemctl restart mariadb