Apache Superset: A story of insecure default keys, thousands of vulnerable systems, few paying attention
If an attacker knows the value of SECRET_KEY, that person can then generate and sign cookies, effectively authenticating as the app administrator.
More than a year after this change was made, on February 9, 2023, Horizon3.ai again checked to see how many Superset instances were configuring their app with a public default secret key. This time they expanded their Shodan.io search to four different default keys – the original, the new one, and two others – one from a deployment template and one from the documentation.
And not much had changed. Out of 3,176 Superset instances, 2,124 were using one of the four default keys. So Horizon3.ai contacted the Apache security team again. And two weeks later, on February 24, 2023, the project maintainers committed that would ship as part of the 2.1 release on April 5, 2023, to"impose harsher measures when a default SECRET_KEY is identified."
South Africa Latest News, South Africa Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Multiple Shootings Leave Woman Dead, Two Others Hurt in New Haven, CTIt was a violent weekend in New Haven. Multiple shootings left three people hurt, including a 26-year-old woman who later died. “No life should be lost,” said Mayor Justin Elicker, D – New Haven. Police say Tayna Rodriguez was struck on Saltonstall Avenue early Sunday morning. “Two individuals that got into a dispute and what it seems is the woman…
Read more »
Still Game and Two Doors Down stars among cast for new thriller filming in GlasgowThe thriller is set on a sleeper train travelling from Glasgow to London
Read more »
Morrisons ration sales of peppers to two per customer as cold weather in Spain hits suppliesSome supermarkets such as Waitrose have run out of stocks of the vegetable and it is understood yellow peppers are in particular short supply
Read more »
Flambé fire kills two after freak accident in Spanish capital Madrid - leaving 10 injuredA fire in an Italian restaurant in Madrid killed two people on Friday night after the eatery was inadvertently set ablaze by a waiter who was flambéeing a dish.
Read more »
Romano confirms Liverpool 'will sign two or three midfielders' as Reds cool interest in defender - Football365Transfer expert Fabrizio Romano claims that Liverpool 'will sign two or three midfielders this summer' with 'many targets being discussed'...
Read more »
Body of teen missing for more than two months found in riverA body discovered in a Dorset river is believed to be that of a missing teen.
Read more »