Attack Chain

1. The attacker gains valid access to Apache Superset, either via authenticated user credentials or by bypassing authentication using a compromised Flask secret.
2. The attacker initiates the creation of a new database connection through the Superset web interface.
3. The attacker provides connection details pointing to a rogue MariaDB server controlled by the attacker.
4. The attacker crafts the 'database_connection_details' request body to ensure the application attempts to connect to the malicious endpoint.
5. The Apache Superset application connects to the attacker-controlled MariaDB server.
6. The rogue server responds to the handshake with a request to perform 'LOAD DATA LOCAL INFILE'.
7. The vulnerable MariaDB/MySQL client library on the Superset host executes the request, reading a targeted file from the host filesystem.
8. The file content is exfiltrated to the attacker-controlled database, completing the unauthorized file read objective.

Impact

Successful exploitation results in arbitrary file read on the host running Apache Superset. This allows attackers to access configuration files, credentials, or other sensitive system data. This vulnerability affects Apache Superset versions < 3.1.3 and 4.0.1.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Upgrade Apache Superset to version 3.1.3, 4.0.1, or later immediately to patch CVE-2024-34693.
• Audit database connection configurations in Apache Superset to identify any suspicious, non-standard, or external endpoints.
• Monitor web application logs for POST requests to database configuration endpoints containing suspicious connection strings or parameters.
• Restrict the ability of the Apache Superset service user to access sensitive system files on the host OS.