{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapachesuperset/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.8,"id":"CVE-2024-34693"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Superset (\u003c 3.1.3)","Superset (4.0.1)"],"_cs_severities":["low"],"_cs_tags":["apache","superset","cve-2024-34693","arbitrary-file-read","authenticated-access"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eCVE-2024-34693 describes a critical input validation vulnerability in Apache Superset, specifically impacting versions prior to 3.1.3 and 4.0.1. The vulnerability arises because Apache Superset allows authenticated users to configure database connection details. If the underlying MariaDB/MySQL client is configured to allow the 'local_infile' parameter, an attacker can point the Superset application to a rogue MariaDB server under their control. By issuing a 'LOAD DATA LOCAL INFILE' command, the rogue server instructs the victim client to read sensitive local files from the filesystem and transmit the contents back to the database. This enables unauthorized disclosure of sensitive server-side data. Access to this feature typically requires an authenticated user with database connection creation privileges or the use of a leaked Flask secret to bypass authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains valid access to Apache Superset, either via authenticated user credentials or by bypassing authentication using a compromised Flask secret.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates the creation of a new database connection through the Superset web interface.\u003c/li\u003e\n\u003cli\u003eThe attacker provides connection details pointing to a rogue MariaDB server controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the 'database_connection_details' request body to ensure the application attempts to connect to the malicious endpoint.\u003c/li\u003e\n\u003cli\u003eThe Apache Superset application connects to the attacker-controlled MariaDB server.\u003c/li\u003e\n\u003cli\u003eThe rogue server responds to the handshake with a request to perform 'LOAD DATA LOCAL INFILE'.\u003c/li\u003e\n\u003cli\u003eThe vulnerable MariaDB/MySQL client library on the Superset host executes the request, reading a targeted file from the host filesystem.\u003c/li\u003e\n\u003cli\u003eThe file content is exfiltrated to the attacker-controlled database, completing the unauthorized file read objective.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary file read on the host running Apache Superset. This allows attackers to access configuration files, credentials, or other sensitive system data. This vulnerability affects Apache Superset versions \u0026lt; 3.1.3 and 4.0.1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Superset to version 3.1.3, 4.0.1, or later immediately to patch CVE-2024-34693.\u003c/li\u003e\n\u003cli\u003eAudit database connection configurations in Apache Superset to identify any suspicious, non-standard, or external endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for POST requests to database configuration endpoints containing suspicious connection strings or parameters.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of the Apache Superset service user to access sensitive system files on the host OS.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T01:30:23Z","date_published":"2026-10-20T01:30:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-34693/","summary":"CVE-2024-34693 is an arbitrary file read vulnerability in Apache Superset (versions \u003c 3.1.3 and 4.0.1) that allows authenticated attackers to leverage rogue MariaDB servers and the LOAD DATA LOCAL INFILE command to exfiltrate sensitive files.","title":"Arbitrary File Read in Apache Superset via CVE-2024-34693","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-34693/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}