CVE-2021-28125: Open Redirect in Apache Superset
Summary
CVE-2021-28125: Open Redirect in Apache Superset. Affects superset versions < 0.34.0. No fix is published. How to fix ↓
Also tracked for
- superset · Bitnami
- apache-superset · PyPI
The same CVE-2021-28125 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards and visualizations from various data sources. The URL shortener functionality in Apache Superset allows users to create shortened URLs for sharing dashboards. However, prior to version 1.1.0, Apache Superset did not properly validate user input, leading to an open redirect vulnerability. This vulnerability could be exploited by a malicious user to create a short URL that appears legitimate but redirects the user to a malicious website.
Vulnerability Detail
The open redirect vulnerability in Apache Superset allows an attacker to create a shortened URL that can be used to redirect users to a malicious website. By exploiting this vulnerability, an attacker can craft a convincing URL that appears to be a legitimate dashboard but actually redirects the user to a malicious site. This can be used for phishing attacks or to trick users into visiting malicious websites that could potentially compromise their systems. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the URL shortener functionality in Apache Superset. This can be done by modifying the configuration settings or disabling the relevant feature in the application. By disabling the URL shortener, the open redirect vulnerability will be mitigated until the application can be upgraded to a fixed version.
Conclusion
The open redirect vulnerability in Apache Superset can be mitigated by upgrading to version 1.1.0 or later. It is important to promptly apply the necessary updates to ensure the security of the application. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and visualizations from various data sources.
An open redirect vulnerability is a security flaw that allows an attacker to craft a URL that redirects users to a different website. This can be used for phishing attacks or to trick users into visiting malicious websites.
The open redirect vulnerability in Apache Superset can be exploited by an attacker to redirect users to a malicious website. This can lead to phishing attacks, the installation of malware, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 1.1.0 or later. This version includes a fix for the open redirect vulnerability.
Yes, a temporary workaround is to disable the URL shortener functionality in Apache Superset. This can be done by modifying the configuration settings or disabling the relevant feature in the application.
Related vulnerabilities
Recent vulnerabilities recorded for superset.
