CVE-2023-39265

Deeper analysis

Apache Superset versions up to and including 2.1.0 contain an input validation flaw that permits SQLite database connections to be registered using alternate driver names such as sqlite+pysqlite or through database import mechanisms. The affected component is the database connection registration logic, which fails to enforce the intended SQLite driver restrictions and can lead to unexpected file creation on the Superset web server. When Superset itself uses SQLite for metadata storage, the issue can further expose confidentiality and integrity risks.

An authenticated attacker with administrative privileges can supply crafted connection strings or import files to trigger the flaw. Successful exploitation allows creation of arbitrary files on the server and, in metadata SQLite deployments, broader unauthorized access or modification of Superset configuration and data.

Public references, including the Apache mailing list thread and PacketStorm disclosures, point to coordinated advisories that address the driver registration bypass and recommend restricting database connection capabilities and avoiding SQLite for production metadata storage. The EPSS score has remained near 0.72 with a peak of 0.74, indicating sustained but not sharply increasing exploitation interest since disclosure.