CVE-2018-8021: Remote Code Execution in Superset
Summary
CVE-2018-8021: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Affects superset versions < 0.23.0. Fixed in 0.23.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Superset is a data exploration and visualization platform that allows users to create interactive dashboards and visualizations. It is widely used for business intelligence and data analytics purposes. However, versions of Superset prior to 0.23 were vulnerable to remote code execution due to the unsafe use of the pickle library for deserialization.
Vulnerability Detail
The vulnerability (CVE-2018-8021) in Superset allowed an attacker to execute arbitrary code remotely. This was possible because the pickle library used an unsafe load method to deserialize data, which could be manipulated by an attacker to execute malicious code on the server. The impact of this vulnerability could be severe, as it could lead to unauthorized access, data theft, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
0.23.0
This is the first release that contains the fix.
pip install --upgrade "superset==0.23.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the use of pickle for deserialization in Superset. This can be achieved by modifying the configuration to use a safer serialization method, such as JSON or MessagePack. Here's an example of how to modify the configuration file to use JSON serialization:
# superset_config.py
SERIALIZATION_METHOD = 'json'
Conclusion
In conclusion, the CVE-2018-8021 vulnerability in Superset allowed for remote code execution, posing a significant risk to the security and integrity of the affected systems. It is crucial to upgrade to the latest version of Superset or apply the recommended workaround to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for superset →
FAQ
Superset is a data exploration and visualization platform used for creating interactive dashboards and visualizations.
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data theft, or complete compromise of the affected system.
To fix this vulnerability, upgrade Superset to version 0.23.0 or later, which includes the necessary security patches.
A temporary workaround is to disable the use of pickle for deserialization in Superset by modifying the configuration to use a safer serialization method, such as JSON or MessagePack.
You can find more information about this vulnerability in the Superset advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/superset/PYSEC-2018-74.yaml
Related vulnerabilities
Recent vulnerabilities recorded for superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
