Point hosts at Superset and flag CVE-2023-27524 by version, then confirm with a local HMAC of the issued session cookie. It never forges a cookie. CISA KEV.
Fetches the session cookie and locally verifies the HMAC signature against known default keys. Vendor Advisory
Detection
Detect fingerprints Apache Superset and flags CVE-2023-27524 by version. No probe.
Report
Summarizes counts for checked, product, affected, and confirmed vulnerable hosts.
Targets
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Apache Superset and sorts each host by whether its version falls in the CVE-2023-27524 range. CVE-2023-27524 is a default Flask SECRET_KEY that lets an attacker forge an admin session. Confirm verifies the cookie the server sent. It does not log in. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public login page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that locally HMACs the session cookie the server already issued against known default SECRET_KEY values. It never forges or submits a cookie.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Superset, then read the version and compare it to the CVE-2023-27524 floors in the graph.
Confirm only those flagged hosts with a local HMAC of the session cookie the server already issued, against known default SECRET_KEY values. It never forges or submits a cookie.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Superset was detected, the version read, the affected flag, and whether the issued cookie matched a default key.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the login page. HMAC of the issued cookie is local. No forged session is sent.
Sample output
The records below are illustrative and do not come from a real run. They show one Superset host inside the CVE-2023-27524 range, one patched host, and one host that is not the product.
Superset 1.4.1 through 2.1.0 that still ship a default Flask SECRET_KEY. A changed key is outside this check even if the version string is old. The compare uses the version the product itself served.
Does a confirmed row mean an admin session was forged?
No. Confirm only HMACs the cookie the server already issued. It never forges or submits a cookie. A confirmed row means that cookie still matches a known default key.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is a local HMAC of an already-issued cookie, only on hosts already in range. It does not log in.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.
What is CVE-2023-27524?
A default Flask SECRET_KEY that lets an attacker forge a Superset session. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms the issued cookie still matches a default key.