CVE-2021-28125: Open Redirect Vulnerability in Apache Superset
Summary
CVE-2021-28125: Open Redirect in Apache Superset. Affects superset versions < 0.34.0. No fix is published. How to fix ↓
Also tracked for
- superset · Bitnami
- apache-superset · PyPI
The same CVE-2021-28125 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data visualization and business intelligence tool designed to help users explore and visualize their data. It provides a rich set of features, including a user-friendly interface for creating dashboards and reports. However, prior to version 1.1.0, Superset had a vulnerability that allowed for the creation of malicious external URLs due to insufficient validation of user input, specifically in its URL shortener functionality.
Vulnerability Detail
The vulnerability identified as CVE-2021-28125 arises from Apache Superset's failure to properly validate user input for open redirects. This oversight allows a malicious user to create a shortened URL that redirects unsuspecting users to potentially harmful external sites. The implications of this vulnerability can lead to phishing attacks, where users are tricked into providing sensitive information, or to the distribution of malware. The vulnerability affects all versions of Superset prior to 1.1.0, with the last affected version being 0.34.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the URL shortener functionality in Superset until they are able to upgrade to a patched version. This can be done by modifying the configuration settings to prevent the creation of external URLs.
Conclusion
The open redirect vulnerability in Apache Superset (CVE-2021-28125) poses significant risks to users by allowing malicious external URLs to be created. It is crucial for users to upgrade to version 1.1.0 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for superset →
FAQ
CVE-2021-28125 is a vulnerability in Apache Superset that allows for open redirects due to insufficient validation of user input.
Any version of Apache Superset prior to 1.1.0 is affected by this vulnerability. Check your version using the command superset version.
The risks include potential phishing attacks and the possibility of users being redirected to malicious sites, which can compromise sensitive information.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires only the Pipfile.lock to function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
