Miggo Logo

CVE-2021-32609: Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page

5.4

CVSS Score
3.1

Basic Information

EPSS Score
0.9334%
Published
5/24/2022
Updated
9/12/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
apache-supersetpip>= 0, < 1.2.01.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper sanitization of chart titles in two phases: 1) During rendering (frontend display), where the title is injected into the DOM without proper escaping, and 2) During storage (backend persistence), where malicious titles aren't sanitized before being saved. The high-confidence entry points to the template rendering logic (common XSS pattern in web frameworks), while the medium-confidence entry addresses the persistence layer based on the vulnerability's description of saving malicious titles. Without commit diffs, these are inferred from typical MVC architecture patterns in web applications and the described attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** Sup*rs*t up to *n* in*lu*in* *.* *o*s not s*nitiz* titl*s *orr**tly on t** *xplor* p***. T*is *llows *n *tt**k*r wit* *xplor* ****ss to s*v* * ***rt wit* * m*li*ious titl*, inj**tin* *tml (in*lu*in* s*ripts) into t** p***.

Reasoning

T** vuln*r**ility st*ms *rom improp*r s*nitiz*tion o* ***rt titl*s in two p**s*s: *) *urin* r*n**rin* (*ront*n* *ispl*y), w**r* t** titl* is inj**t** into t** *OM wit*out prop*r *s**pin*, *n* *) *urin* stor*** (***k*n* p*rsist*n**), w**r* m*li*ious t