CVE-2021-28125: Apache Superset External URL Open Redirect Vulnerability
Summary
CVE-2021-28125: Apache Superset Open Redirect. Affects superset versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Also tracked for
- superset · PyPI
- superset · PyPI
- apache-superset · PyPI
The same CVE-2021-28125 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data visualization and business intelligence tool designed to help users explore and visualize data through dashboards. It provides a rich set of features for data exploration, including the ability to create and share dashboards, perform SQL queries, and integrate with various data sources. However, versions up to and including 1.0.1 have a vulnerability that allows for the creation of malicious external URLs, potentially leading to security risks for users.
Vulnerability Detail
The vulnerability arises from the lack of input validation for user-generated URLs in the URL shortener functionality of Apache Superset. This oversight allows a malicious user to create a short URL that redirects to an external site, which could be used to deceive users into clicking the link. The potential ramifications include phishing attacks, where users may unknowingly provide sensitive information to an attacker, and the compromise of user trust in the application.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the URL shortener functionality until the application is updated to a patched version. This can be done by modifying the configuration settings in the Superset configuration file to restrict external URL creation.
Conclusion
The CVE-2021-28125 vulnerability in Apache Superset poses a significant risk by allowing malicious external URL creation. Users are strongly advised to update to version 1.0.2 or later to mitigate this risk. Additionally, temporary workarounds can be implemented until the update is applied. Monitoring tools like Vulert can assist in keeping applications secure.
See every vulnerability recorded for superset →
FAQ
CVE-2021-28125 is a vulnerability in Apache Superset that allows for the creation of malicious external URLs due to insufficient input validation.
If you are using Apache Superset version 1.0.1 or earlier, your installation is affected by this vulnerability.
The risks include potential phishing attacks and loss of user trust, as attackers can redirect users to malicious sites.
Yes, a patch is available in version 1.0.2 and later of Apache Superset. Users should upgrade to this version to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for superset.
