{"vulnerability": "CVE-2023-39265", "sightings": [{"uuid": "d819c2e9-be78-4a73-a857-df007157f186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:46.000000Z"}, {"uuid": "d4434ab9-aedd-4e8f-b8cd-dc976b82b71d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:56.000000Z"}, {"uuid": "5107e431-f9ea-40de-8e88-6914a09230c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:01.000000Z"}, {"uuid": "072dae11-1c28-45c7-a2ea-32c404c516a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwkbd7mkem2m", "content": "", "creation_timestamp": "2025-08-16T21:02:22.790599Z"}, {"uuid": "47422aac-de2f-47bf-b7fe-f6c8cd3eff21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb", "content": "", "creation_timestamp": "2023-10-12T21:34:40.000000Z"}, {"uuid": "b4e16ef6-d847-4210-8bbf-4fabdcea5518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "published-proof-of-concept", "source": "Telegram/hqzcq-N-UmfLuy_GrV60Wdv72OSiDR6dOzg10bG3ca7Czg", "content": "", "creation_timestamp": "2023-09-07T13:42:21.000000Z"}, {"uuid": "8b83638d-7cec-44be-95b7-6b39b2d5f5f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "https://t.me/KomunitiSiber/755", "content": "Alert: Apache SuperSet Vulnerabilities Expose Servers to Remote Code Execution Attacks\nhttps://thehackernews.com/2023/09/alert-apache-superset-vulnerabilities.html\n\nPatches have been released to address two new security vulnerabilities in Apache SuperSet that could be exploited by an attacker to gain remote code execution on affected systems.\nThe update (version 2.1.1) plugs\u00a0CVE-2023-39265\u00a0and\u00a0CVE-2023-37941, which make it possible to conduct nefarious actions once a bad actor is able to gain control of Superset\u2019s metadata database.\nOutside of these", "creation_timestamp": "2023-09-07T13:47:33.000000Z"}, {"uuid": "91fa348a-4c80-420b-a8d3-f186ac51f412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "https://t.me/thehackernews/3838", "content": "Apache SuperSet users, beware! \n \nA critical update has been released to patch two new vulnerabilities (CVE-2023-39265 & CVE-2023-37941) that could expose your servers to remote code execution attacks. \n \nFind out here: https://thehackernews.com/2023/09/alert-apache-superset-vulnerabilities.html", "creation_timestamp": "2023-09-07T13:31:34.000000Z"}, {"uuid": "3de775a1-bf2a-4e77-ae56-4e054635c1f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/8984", "content": "#exploit\n1. CVE-2023-4634:\nRCE Exploit for Wordpress Media-Library Plugin < 3.10\nhttps://github.com/Patrowl/CVE-2023-4634\n\n2. CVE-2023-27524, CVE-2023-39265, CVE-2023-37941:\nApache Superset\u00a0- RCE, Credential Harvesting & More\nhttps://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-and-more", "creation_timestamp": "2023-09-07T11:01:26.000000Z"}, {"uuid": "abd8b129-2d2a-468f-9eeb-cbf25648a7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39265", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb", "content": "{\"aliases\": [], \"arch\": \"python\", \"author\": [\"h00die\", \"paradoxis\", \"Spencer McIntyre\", \"Naveen Sunkavally\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Apache Superset versions <= 2.0.0 utilize Flask with a known default secret key which is used to sign HTTP cookies.\\n          These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that\\n          of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user. From there the\\n          Superset database is mounted, and credentials are pulled. A dashboard is then created. Lastly a pickled python payload can be\\n          set for that dashboard within Superset's database which will trigger the RCE.\\n\\n          An attempt to clean up ALL of the dashboard key values and reset them to their previous values happens during the cleanup phase.\", \"disclosure_date\": \"2023-09-06\", \"fullname\": \"exploit/linux/http/apache_superset_cookie_sig_rce\", \"is_install_path\": true, \"mod_time\": \"2024-07-24 16:42:43 +0000\", \"name\": \"Apache Superset Signed Cookie RCE\", \"needs_cleanup\": null, \"notes\": {\"RelatedModules\": [\"auxiliary/gather/apache_superset_cookie_sig_priv_esc\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb\", \"platform\": \"Python\", \"post_auth\": true, \"rank\": 400, \"ref_name\": \"linux/http/apache_superset_cookie_sig_rce\", \"references\": [\"URL-https://github.com/Paradoxis/Flask-Unsign\", \"URL-https://vulcan.io/blog/cve-2023-27524-in-apache-superset-what-you-need-to-know/\", \"URL-https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/\", \"URL-https://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-and-more/\", \"URL-https://github.com/horizon3ai/CVE-2023-27524/blob/main/CVE-2023-27524.py\", \"EDB-51447\", \"CVE-2023-27524\", \"CVE-2023-37941\", \"CVE-2023-39265\"], \"rport\": 8088, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:22.604769Z"}]}