CyberRota Analysis
AI-GeneratedApache Superset versions 1.5.0 to 5.0.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to flawed regex patterns in the sql_parse.py component, which can be exploited by authenticated attackers through crafted SQL queries. This vulnerability can lead to significant performance degradation and service unavailability. Organizations using affected versions should prioritize upgrading to version 6.0.0 and consider implementing WAF rules and rate limiting on critical endpoints to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.
Related CVEs
Other vulnerabilities affecting the same vendor(s)