CVE-2024-39887 Information

Description

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically certain engine-specific functions are not checked which allows attackers to bypass Apache Superset’s SQL authorization. To mitigate this a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version query_to_xml inet_server_addr and inet_client_addr. Additional functions can be added to this list for increased protection.

This issue affects Apache Superset: before 4.0.2.

Users are recommended to upgrade to version 4.0.2 which fixes the issue.

Reference

https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz http://www.openwall.com/lists/oss-security/2024/07/16/5