.. / CVE-2023-27524

• Auth Bypass
• Nuclei
• Web

Exploit for Apache Superset - Authentication Bypass (CVE-2023-27524)

Description:

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Nuclei Template

View the template here CVE-2023-27524.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-27524.yaml

References: