CVE-2021-41971 Explained : Impact and Mitigation

Apache Superset up to version 1.3.0 is affected by a SQL injection vulnerability when ENABLE_TEMPLATE_PROCESSING is enabled. This CVE was reported by Kevin Kusnardi.

Understanding CVE-2021-41971

Apache Superset is vulnerable to SQL injection when configured with ENABLE_TEMPLATE_PROCESSING on, allowing a malicious user to execute SQL commands.

What is CVE-2021-41971?

CVE-2021-41971 refers to a SQL injection vulnerability in Apache Superset versions up to and including 1.3.0 when ENABLE_TEMPLATE_PROCESSING is enabled.

The Impact of CVE-2021-41971

This vulnerability can be exploited by an authenticated user to perform SQL injection attacks, potentially leading to data leaks or unauthorized actions.

Technical Details of CVE-2021-41971

Apache Superset CVE-2021-41971 is classified with the following details:

Vulnerability Description

The issue arises when a malicious authenticated user sends an HTTP request with a custom URL, allowing SQL injection.

Affected Systems and Versions

Product: Apache Superset
Vendor: Apache Software Foundation
Version: Apache Superset 1.3.0 and lower

Exploitation Mechanism

The vulnerability occurs when ENABLE_TEMPLATE_PROCESSING is activated, enabling an attacker to inject SQL commands through specially crafted URLs.

Mitigation and Prevention

To address CVE-2021-41971, follow these steps:

Immediate Steps to Take

Disable ENABLE_TEMPLATE_PROCESSING (disabled by default)
Upgrade to Apache Superset version 1.3.1

Long-Term Security Practices

Regularly review and update security configurations
Train users on safe URL handling and authentication practices

Patching and Updates

Ensure timely installation of security patches and updates provided by Apache Software Foundation.