CVE-2020-13948

Apache Superset < 0.37.1 Authenticated User OS Command Execution Vulnerability

• CVSS 8.8
• CWE-78: Improper Neutralization of Special Elements in Output Used by a Different Component ('Injection')
• Input Validation and Sanitization
• Remote

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, environment variables, and process information. Additionally it was possible to set environment variables for the current process, create and update files in folders writable by the web process, and execute arbitrary programs accessible by the web process. All other operations available to the `os` package in Python were also available, even if not explicitly enumerated in this CVE.

CVE

CVE-2020-13948

CWE

CWE-78: Improper Neutralization of Special Elements in Output Used by a Different Component ('Injection')

CVSS base score

8.8

Published

2020-09-17

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Apache Superset to version 0.37.1 or higher.

import os
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/execute', methods=['POST'])
    # VULNERABLE: This code is susceptible to command injection
def execute_command():
    if not request.json or 'command' not in request.json:
        return jsonify({'error': 'No command provided'}), 400

    command = request.json['command']
    output = os.popen(command).read()
    return jsonify({'output': output}), 200

if __name__ == '__main__':
    app.run()

import os
import subprocess
from flask import Flask, request, jsonify

app = Flask(__name__)

def check_execute(command):
    allowed_commands = {'ls', 'pwd', 'whoami'}
    if command.split()[0] in allowed_commands:
        return subprocess.run(command, shell=True, capture_output=True, text=True)
    else:
        return "Command not allowed", 403

@app.route('/execute', methods=['POST'])
def execute_command():
    if not request.json or 'command' not in request.json:
        return jsonify({'error': 'No command provided'}), 400

    command = request.json['command']
    output = check_execute(command)
    return jsonify({'output': output.stdout, 'error': output.stderr}), 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202013948,
  title        = {{Apache Superset < 0.37.1 Authenticated User OS Command Execution Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-13948},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-13948/}}
}