Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-43701

CVE-2023-43701: Apache Superset Cross-site Scripting vulnerability

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-43701
GHSA ID
GHSA-wq8q-99p5-xfrw
EPSS Score
0.39846%
CWE
CWE-79
Published
11/27/2023
Updated
11/28/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
apache-supersetpip< 2.1.22.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) Insecure input handling in chart metadata updates (PUT) allowing XSS storage, and 2) Deprecated API endpoints (GET) returning unsanitized metadata with improper response types. The ChartRestApi class would logically contain these methods in Superset's REST API implementation. The combination of missing input validation in write operations and improper Content-Type headers in read operations creates the XSS chain. While exact code isn't visible, Superset's architecture and vulnerability description strongly suggest these REST handlers as the vulnerable components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Improp*r p*ylo** v*li**tion *n* *n improp*r R*ST *PI r*spons* typ*, m*** it possi*l* *or *n *ut**nti**t** m*li*ious **tor to stor* m*li*ious *o** into ***rt's m*t***t*, t*is *o** *oul* **t *x**ut** i* * us*r sp**i*i**lly ****ss*s * sp**i*i* **pr***t*

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) Ins**ur* input **n*lin* in ***rt m*t***t* up**t*s (PUT) *llowin* XSS stor***, *n* *) **pr***t** *PI *n*points (**T) r*turnin* uns*nitiz** m*t***t* wit* improp*r r*spons* typ*s. T** `***rtR*st*pi` *l*ss