{"id":108092,"date":"2023-04-26T12:48:13","date_gmt":"2023-04-26T10:48:15","guid":{"rendered":"https:\/\/prohoster.info\/?p=108092"},"modified":"2023-04-27T10:34:34","modified_gmt":"2023-04-27T08:34:34","slug":"67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","title":{"rendered":"67% af de offentlige servere Apache Superset bruger en adgangsn\u00f8gle fra eksempelindstillingerne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Horizon3 har p\u00e5peget sikkerhedsproblemer i de fleste installationer af datavisualiserings- og analysetplatformen Apache Superset. P\u00e5 2124 af de 3176 offentlige servere, der blev unders\u00f8gt, er der blevet identificeret anvendelse af den standard krypteringsn\u00f8gle, der er angivet i eksempelkonfigurationsfilen. Denne n\u00f8gle bruges i Python-biblioteket Flask til at generere sessionscookies, hvilket giver en angrebspartner med kendskab til n\u00f8glen mulighed for at danne falske sessionparametre, oprette forbindelse til webgr\u00e6nsefladen for Apache Superset og hente data fra tilknyttede databaser eller udf\u00f8re kode med rettigheder fra Apache Superset. <\/p>\n

Det er interessant, at forskerne oprindeligt informerede udviklerne om problemet allerede i 2021, hvorefter v\u00e6rdien af parameteren SECRET_KEY i Apache Superset 1.4.1, der blev udgivet i januar 2022, blev \u00e6ndret til strengen «CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET». Koden fik tilf\u00f8jet en kontrol, der udskriver en advarsel i loggen, hvis denne v\u00e6rdi er til stede. <\/p>\n

I februar i \u00e5r besluttede forskerne at gentage scanningen af de s\u00e5rbare systemer og blev konfronteret med, at meget f\u00e5 reagerede p\u00e5 advarslen, og 67% servere<\/a> Apache Superset forts\u00e6tter stadig med at anvende n\u00f8gler fra konfigurations-eksempler, deploymentskabeloner eller dokumentation. Blandt organisationerne, der bruger standardn\u00f8glerne, er der ogs\u00e5 nogle store virksomheder, universiteter og offentlige institutioner.

\"67%<\/center> <\/p>\n

Angivelsen af arbejde n\u00f8gle i eksempelkonfigurationen er nu blevet betragtet som en s\u00e5rbarhed (CVE-2023-27524), som blev rettet i Apache Superset 2.1 ved at introducere en fejlmeddelelse, der forhindrer platformen i at starte, n\u00e5r den n\u00e6vnte n\u00f8gle benyttes (kun n\u00f8glen angivet i eksempelkonfigurationen for den aktuelle version tages i betragtning, \u00e6ldre standardn\u00f8gler og n\u00f8gler fra skabeloner og dokumentation blokeres ikke). Der er udviklet et s\u00e6rligt script til at tjekke for s\u00e5rbarheden p\u00e5 netv\u00e6rket.

\"67%<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Horizon3 \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Apache Superset. \u041d\u0430 2124 \u0438\u0437 3176 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 Apache Superset \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u0438\u043f\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0444\u0430\u0439\u043b\u0430 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0414\u0430\u043d\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Flask \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u0445 Cookie, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043d\u0430\u044e\u0449\u0435\u043c\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":108093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4767% af offentlige servere med Apache Superset bruger en adgangsn\u00f8gle fra eksempelkonfigurationerne | ProHoster","description":"Forskere fra Horizon3 har p\u00e5peget sikkerhedsproblemer i de fleste installationer af datavisualiserings- og analysetplatformen Apache Superset.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4767% \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Apache Superset \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u043b\u044e\u0447 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Horizon3 \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Apache Superset.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-26T10:48:15+00:00","article:modified_time":"2023-04-27T08:34:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:51:33","updated":"2026-02-09 16:51:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/108092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=108092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/108092\/revisions"}],"predecessor-version":[{"id":158951,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/108092\/revisions\/158951"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/108093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=108092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=108092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=108092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}