Bafuputsi ba Horizon3 ba ile ba lebisa tlhokomelo mathateng a ts'ireletso litsing tse ngata tsa tlhahlobo ea data ea Apache Superset le sethala sa pono. Ka 2124 ho li-server tse 3176 tsa sechaba tse ithutoang le Apache Superset, ts'ebeliso ea senotlolo se tloaelehileng sa encryption se boletsoeng ke kamehla faeleng ea tlhophiso ea mohlala e ile ea fumanoa. Senotlolo sena se sebelisoa laebraring ea Flask Python ho hlahisa li-Cookies tsa seboka, tse lumellang mohlaseli ea tsebang senotlolo sa ho hlahisa liparamente tse iqapetsoeng, ho hokahanya le sehokelo sa marang-rang sa Apache Superset le ho kenya data ho tsoa litsing tse hokahaneng, kapa ho hlophisa ts'ebetso ea khoutu ka litokelo tsa Apache Superset. .
Ho khahlisang, bafuputsi ba ile ba tsebisa baetsi ka bothata ka 2021, kamora hore ho lokolloe Apache Superset 1.4.1, e thehiloeng ka Pherekhong 2022, boleng ba paramente ea SECRET_KEY bo ile ba nkeloa sebaka ke mohala "CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET", cheke e ile ea fetoloa. e kenyellelitsoe khoutu, haeba boleng bona bo hlahisa temoso ho log.
Ka Hlakola selemong sena, bafuputsi ba nkile qeto ea ho pheta tlhahlobo ea lits'ebetso tse tlokotsing mme ba tobane le taba ea hore ke batho ba fokolang ba ileng ba ela hloko temoso mme 67% ea li-server tsa Apache Superset li ntse li tsoela pele ho sebelisa linotlolo ho tsoa mehlala ea tlhophiso, litempele tsa ho tsamaisa kapa litokomane. Ka nako e ts'oanang, lik'hamphani tse ling tse kholo, liunivesithi le mekhatlo ea mmuso li ne li le har'a mekhatlo e sebelisang linotlolo tsa kamehla.
Ho hlakisa senotlolo sa ho sebetsa ho tlhophiso ea mohlala hona joale ho nkuoa e le ts'oaetso (CVE-2023-27524), e ileng ea lokisoa tokollong ea Apache Superset 2.1 ka tlhahiso ea phoso e thibelang sethala ho qala ha ho sebelisoa senotlolo se boletsoeng ho. mohlala (senotlolo feela se boletsoeng mofuteng oa mohlala oa phetolelo ea morao-rao se nkoa, linotlolo tsa khale le linotlolo tse tsoang ho li-templates le litokomane ha lia thibeloa). Ho hlahisitsoe script e khethehileng ho hlahloba boteng ba bofokoli holim'a marang-rang.
Source: opennet.ru