GitHub - r3dxpl0it/Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021: CVE-2018-8021 Proof-Of-Concept and Exploit

IBM : Apache Superset could allow a remote attacker to execute arbitrary code on the system, caused by the use of unsafe load method from the pickle library to deserialize data. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

usage: [-h] -t TCP -tp TPORT -i IP -p PORT -U USER -P PASSW

optional arguments:
  -h, --help            show this help message and exit
  -t TCP, --tcp TCP     tcp ip for shell
  -tp TPORT, --tport TPORT
                        tcp port for shell
  -i IP, --ip IP        ip
  -p PORT, --port PORT  port
  -U USER, --user USER  User belong to Superset 
  -P PASSW, --passw PASSW
                        password of the user !

Note : User and Pass Must belong to a user that can import Dashboards on Superset!!!

Please Note Original PoC has been written by David May [[email protected]][]


  1. stealth/sshttp
  2. IOActive/jdwp-shellifier
  3. python学习socket的客户端实现 - CSDN博客
  4. GitHub - pyn3rd/CVE-2018-3245: CVE-2018-3245-PoC
  5. Real World CTF 2018 | Magic Tunnel · zaratec