Overview:
Apache Superset utilizes a configurable dictionary,
DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially
sensitive SQL functions within SQL Lab and charts. While this feature
included restrictions for engines like PostgreSQL , a vulnerability was
reported where the default list for the ClickHouse engine was incomplete.
This gap allowed users with query access to a ClickHouse database to
execute functions such as version(), currentDatabase(), and hostName() to
extract sensitive information about the database server and its
configuration. This advisory addresses the fix for this issue, which adds
these functions to the default ClickHouse blocklist.
Affected Versions:
Apache Superset < 4.1.2
Recommendations:
We recommend all users upgrade to Apache Superset 4.1.2 or later, which
includes the fix (PR #31198).
For users on older versions who cannot upgrade immediately, we strongly
recommend manually adding the following configuration to your
superset_config.py to block these functions:
DISALLOWED_SQL_FUNCTIONS = {
"clickhouse": {"url", "version", "currentDatabase", "hostName"},
}
Note: If you already have a DISALLOWED_SQL_FUNCTIONS dictionary in your
configuration, please merge this ClickHouse list with your existing entries.
Acknowledgments:
We would like to thank Saif Salah for responsibly reporting this
vulnerability.
Best Regards,
Pedro Sousa / Apache Superset Security Team
