CVE-2024-39887: Apache Superset SQLi Vulnerability

CVE-2024-39887 Overview

CVE-2024-39887 is a SQL Injection vulnerability in Apache Superset that arises from improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization mechanisms. This vulnerability enables unauthorized access to sensitive data and potential manipulation of backend database systems.

Critical Impact

Unauthenticated remote attackers can bypass SQL authorization controls and execute arbitrary SQL commands against the underlying database, potentially leading to complete data compromise, unauthorized data modification, or denial of service.

Affected Products

• Apache Superset versions before 4.0.2
• All Apache Superset deployments using PostgreSQL databases with vulnerable engine-specific functions
• Self-hosted and cloud-based Apache Superset installations without the DISALLOWED_SQL_FUNCTIONS configuration

Discovery Timeline

• July 16, 2024 - CVE-2024-39887 published to NVD
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2024-39887

Vulnerability Analysis

This SQL Injection vulnerability exists within Apache Superset's SQL parsing and authorization layer. The core issue lies in the incomplete validation of SQL queries before execution. While Apache Superset implements SQL authorization controls to prevent unauthorized database operations, certain PostgreSQL engine-specific functions were not included in the security checks.

The vulnerable functions that bypass SQL authorization include version, query_to_xml, inet_server_addr, and inet_client_addr. An attacker can craft malicious SQL queries using these functions to extract sensitive information about the database server, including version details, internal network information, and potentially leverage these capabilities for further exploitation.

The network-based attack vector with no authentication required makes this vulnerability particularly dangerous in environments where Apache Superset is exposed to untrusted networks.

Root Cause

The root cause of CVE-2024-39887 is the incomplete implementation of SQL function allowlisting within Apache Superset's SQL authorization framework. The application failed to account for PostgreSQL-specific functions that can be abused to leak sensitive information or bypass intended security controls.

The SQL parser did not properly sanitize or block engine-specific functions, allowing these functions to execute without being subjected to the same authorization checks applied to standard SQL commands. This oversight in the input validation logic created an exploitable gap in the security model.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker with network access to the Apache Superset instance can exploit this vulnerability by:

1. Crafting SQL queries that include PostgreSQL-specific functions like version(), query_to_xml(), inet_server_addr(), or inet_client_addr()
2. Submitting these queries through Superset's SQL Lab or other query interfaces
3. Bypassing the SQL authorization layer due to the unchecked functions
4. Extracting sensitive database information or performing unauthorized operations

The vulnerability allows attackers to enumerate database server information, discover internal network topology, and potentially chain this with other attack techniques to achieve broader system compromise.

Detection Methods for CVE-2024-39887

Indicators of Compromise

• Unusual SQL queries containing PostgreSQL-specific functions such as version(), query_to_xml(), inet_server_addr(), or inet_client_addr() in application logs
• Unexpected database information disclosure or error messages revealing server metadata
• Anomalous query patterns originating from the Superset application layer
• Database audit logs showing execution of system information functions

Detection Strategies

• Implement database query logging and monitor for the use of known vulnerable functions (version, query_to_xml, inet_server_addr, inet_client_addr)
• Deploy web application firewall (WAF) rules to detect SQL injection patterns targeting PostgreSQL-specific functions
• Enable Apache Superset application logging and audit query submissions for suspicious patterns
• Use SentinelOne Singularity Platform to monitor for exploitation attempts and anomalous database activity

Monitoring Recommendations

• Configure real-time alerting for SQL queries containing the identified vulnerable PostgreSQL functions
• Establish baseline query patterns and alert on deviations that may indicate exploitation attempts
• Monitor network traffic between Superset and database servers for unusual data exfiltration patterns
• Implement database activity monitoring (DAM) solutions to detect unauthorized function execution

How to Mitigate CVE-2024-39887

Immediate Actions Required

• Upgrade Apache Superset to version 4.0.2 or later immediately
• Configure the new DISALLOWED_SQL_FUNCTIONS configuration key to block vulnerable functions
• Review application and database logs for any historical exploitation attempts
• Restrict network access to Apache Superset instances to trusted networks only
• Implement additional input validation and SQL query filtering at the application layer

Patch Information

Apache has released version 4.0.2 which addresses this SQL Injection vulnerability. The patch introduces a new configuration key named DISALLOWED_SQL_FUNCTIONS that blocks the use of vulnerable PostgreSQL functions by default. Users should upgrade to version 4.0.2 or later to receive the fix.

For detailed patch information and security advisories, refer to the Apache Security Thread and the Openwall OSS-Security Discussion.

Workarounds

• If immediate upgrade is not possible, manually configure the DISALLOWED_SQL_FUNCTIONS setting to block version, query_to_xml, inet_server_addr, and inet_client_addr functions
• Implement network-level access controls to restrict who can reach the Apache Superset interface
• Deploy a web application firewall with custom rules to detect and block SQL injection attempts targeting PostgreSQL functions
• Consider placing Apache Superset behind a reverse proxy with additional query filtering capabilities

# Configuration example for Apache Superset superset_config.py
# Add the following to block vulnerable PostgreSQL functions
DISALLOWED_SQL_FUNCTIONS = {'version', 'query_to_xml', 'inet_server_addr', 'inet_client_addr'}

# Additional functions can be added to this set for enhanced protection
# DISALLOWED_SQL_FUNCTIONS.add('additional_function_name')