{"id":108092,"date":"2023-04-26T12:48:13","date_gmt":"2023-04-26T10:48:15","guid":{"rendered":"https:\/\/prohoster.info\/?p=108092"},"modified":"2023-04-27T10:34:34","modified_gmt":"2023-04-27T08:34:34","slug":"67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","title":{"rendered":"67% nyilv\u00e1nos Apache Superset szerver haszn\u00e1l p\u00e9ldaszer\u0171 hozz\u00e1f\u00e9r\u00e9si kulcsot a be\u00e1ll\u00edt\u00e1sokb\u00f3l","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Horizon3 kutat\u00f3i \u00e9szrevett\u00e9k a biztons\u00e1gi probl\u00e9m\u00e1kat az Apache Superset adatvizualiz\u00e1l\u00f3 platform t\u00f6bbs\u00e9gi telep\u00edt\u00e9sein\u00e9l. A 3176 vizsg\u00e1lt nyilv\u00e1nos Apache Superset szerverb\u0151l 2124 eset\u00e9ben egy p\u00e9ldak\u00e9nt megadott, alap\u00e9rtelmezett titkos\u00edt\u00f3 kulcs haszn\u00e1lat\u00e1t \u00e1llap\u00edtott\u00e1k meg. E kulcsot a Flask Python k\u00f6nyvt\u00e1r haszn\u00e1lja a munkamenet s\u00fctik gener\u00e1l\u00e1s\u00e1ra, ami lehet\u0151v\u00e9 teszi egy ismeretlen t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy hamis munkamenet param\u00e9tereket \u00e1ll\u00edtson el\u0151, csatlakozzon az Apache Superset webes fel\u00fclet\u00e9hez, \u00e9s adatokat t\u00f6lts\u00f6n le az \u00f6sszekapcsolt adatb\u00e1zisokb\u00f3l vagy k\u00f3dot futtasson Apache Superset jogk\u00f6r\u00e9vel. <\/p>\n

\u00c9rdekes, hogy a kutat\u00f3k m\u00e1r 2021-ben \u00e9rtes\u00edtett\u00e9k a fejleszt\u0151ket a probl\u00e9m\u00e1r\u00f3l, ezt k\u00f6vet\u0151en az Apache Superset 1.4.1-es kiad\u00e1s\u00e1ban, amelyet 2022 janu\u00e1rj\u00e1ban alak\u00edtottak ki, a SECRET_KEY param\u00e9ter \u00e9rt\u00e9k\u00e9t a «CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET» karakterl\u00e1ncra cser\u00e9lt\u00e9k, \u00e9s a k\u00f3dba be\u00e9p\u00edtettek egy ellen\u0151rz\u00e9st, amely ezt az \u00e9rt\u00e9ket napl\u00f3zva figyelmeztet\u00e9st ad ki. <\/p>\n

Id\u00e9n febru\u00e1rban a kutat\u00f3k \u00fagy d\u00f6nt\u00f6ttek, hogy megism\u00e9tlik a sebezhet\u0151 rendszerek vizsg\u00e1lat\u00e1t, \u00e9s tapasztalt\u00e1k, hogy a figyelmeztet\u00e9sekre kevesen figyelnek, \u00edgy 67% szerverek<\/a> Az Apache Superset tov\u00e1bbra is haszn\u00e1lja a konfigur\u00e1ci\u00f3s p\u00e9ld\u00e1kban, telep\u00edt\u00e9si sablonokban vagy dokument\u00e1ci\u00f3ban tal\u00e1lhat\u00f3 kulcsokat. Ezen k\u00edv\u00fcl az alap\u00e9rtelmezett kulcsokat haszn\u00e1l\u00f3 szervezetek k\u00f6z\u00f6tt tal\u00e1lhat\u00f3 n\u00e9h\u00e1ny nagyv\u00e1llalat, egyetem \u00e9s \u00e1llami int\u00e9zm\u00e9ny is.

\"67%<\/center> <\/p>\n

A m\u0171k\u00f6d\u0151 kulcs megad\u00e1sa a konfigur\u00e1ci\u00f3s p\u00e9ld\u00e1ban most sebezhet\u0151s\u00e9gk\u00e9nt (CVE-2023-27524) van \u00e9rt\u00e9kelve, amelyet az Apache Superset 2.1-es verzi\u00f3j\u00e1nak kiad\u00e1s\u00e1val h\u00e1r\u00edtottak el egy olyan hiba\u00fczenet bevezet\u00e9s\u00e9vel, amely blokkolja a platform ind\u00edt\u00e1s\u00e1t, ha a p\u00e9ld\u00e1ban megadott kulcsot haszn\u00e1lj\u00e1k (csak az aktu\u00e1lis verzi\u00f3 konfigur\u00e1ci\u00f3s p\u00e9ld\u00e1j\u00e1ban megadott kulcsot veszik figyelembe, az ilyen r\u00e9gi mintakulcsok \u00e9s a sablonokb\u00f3l illetve dokument\u00e1ci\u00f3b\u00f3l sz\u00e1rmaz\u00f3 kulcsok nincsenek blokkolva). A sebezhet\u0151s\u00e9g h\u00e1l\u00f3zati ellen\u0151rz\u00e9s\u00e9re egy speci\u00e1lis szkriptet javasoltak.

\"67%<\/center>
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Horizon3 \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Apache Superset. \u041d\u0430 2124 \u0438\u0437 3176 \u0438\u0437\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 Apache Superset \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u0438\u043f\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0444\u0430\u0439\u043b\u0430 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438. \u0414\u0430\u043d\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Flask \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u044b\u0445 Cookie, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043d\u0430\u044e\u0449\u0435\u043c\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":108093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4767% nyilv\u00e1nos Apache Superset szerver haszn\u00e1l p\u00e9ldabe\u00e1ll\u00edt\u00e1sb\u00f3l sz\u00e1rmaz\u00f3 hozz\u00e1f\u00e9r\u00e9si kulcsot | ProHoster","description":"A Horizon3 kutat\u00f3i \u00e9szrevett\u00e9k a biztons\u00e1gi probl\u00e9m\u00e1kat az Apache Superset adatvizualiz\u00e1l\u00f3 platform t\u00f6bbs\u00e9gi telep\u00edt\u00e9sein\u00e9l.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4767% \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Apache Superset \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u043b\u044e\u0447 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Horizon3 \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Apache Superset.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/67-publichnyh-serverov-apache-superset-ispolzuyut-klyuch-dostupa-iz-primera-nastroek","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-26T10:48:15+00:00","article:modified_time":"2023-04-27T08:34:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:51:33","updated":"2026-02-09 16:51:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=108092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108092\/revisions"}],"predecessor-version":[{"id":158951,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108092\/revisions\/158951"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/108093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=108092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=108092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=108092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}