Apache Superset Session Validation Bypass and Remote Code Execution via Default SECRET_KEY (CVE-2023-27524)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-27524) resides in the session validation mechanism of Apache Superset. Apache Superset utilizes the Flask web framework, which relies on a SECRET_KEY to cryptographically sign and validate session cookies. In versions up to and including 2.0.1, the application shipped with well-known default SECRET_KEY values in its configuration templates (CWE-1188). If administrators deploy the application without overriding this default key, the integrity of the session management system is entirely compromised.

2. Exploitation Mechanics & Attack Scenario

An attacker begins by harvesting session cookies from a target Superset instance and attempts to verify if they are signed using known default keys (such as '\x02\x01thisismysupersecretkey\x01\x02'). Once a match is found, the attacker uses Flask session-signing utilities to craft a forged session cookie containing administrative user identifiers (typically user ID 1). When this forged cookie is presented to the server, the application validates the signature against the default key and authenticates the attacker as an administrator. With administrative access, the attacker can execute arbitrary SQL queries or leverage built-in features to achieve Remote Code Execution (RCE).

3. Infrastructure & Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. Successful exploitation allows complete compromise of the Superset instance, exposing sensitive business intelligence data, database credentials, and underlying cloud or on-premise infrastructure. It serves as an entry point for lateral movement within the corporate network.