CVE-2022-27479

The SQL injection vulnerability in Apache Superset allows an attacker to craft malicious chart data requests that execute arbitrary SQL queries against the underlying database. Successful exploitation could result in the extraction of sensitive data, including user credentials, financial information, and business-critical data stored within the database. Depending on the database permissions granted to the Superset user, an attacker might also be able to modify or delete data, or even gain control of the database server itself. This vulnerability is particularly concerning given Superset's role in data visualization and business intelligence, where access to sensitive data is common. The impact could be catastrophic, leading to data breaches, financial losses, and reputational damage.

Organizations utilizing Apache Superset for data visualization and business intelligence are at risk, particularly those running versions prior to 1.4.2. Environments with sensitive data stored in the database, such as financial records or user credentials, face a heightened risk of compromise. Shared hosting environments where multiple users share the same Superset instance are also particularly vulnerable.

• python / server:

import requests
import urllib.parse

url = "http://localhost:8888/superset/chart/"  # Replace with your Superset URL
payload = "' OR 1=1 -- "

# Construct the malicious URL
params = {'slice_id': payload}
full_url = url + str(params)

# Send the request
response = requests.get(full_url)

# Check for SQL injection indicators in the response
if "SELECT" in response.text:
    print("Possible SQL injection detected!")
else:
    print("No SQL injection detected.")

• generic web:

curl -s -X GET "http://your-superset-host/superset/chart/?slice_id=test' OR 1=1 -- " | grep -i "select"

1. 2022-04-13Disclosure

   disclosure

2. 2022-04-13Patch

   patch

1. Reserviert2022-03-21
2. Veröffentlicht2022-04-13
3. Geändert2025-02-05
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-27479 is to upgrade Apache Superset to version 1.4.2 or higher, which includes the necessary fix. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. These might include restricting access to Superset dashboards containing sensitive data, carefully reviewing and validating all user inputs, and implementing stricter database access controls for the Superset user. Web application firewalls (WAFs) configured to detect and block SQL injection attempts can also provide an additional layer of protection. After upgrading, verify the fix by attempting to craft a simple SQL injection payload within a chart data request and confirming that it is properly sanitized and does not execute arbitrary SQL.