Full Report
Reverse engineering GHSA-vwf4-m7j8-wcjf with AI to accelerate defense.
Analysis Summary
# Vulnerability: Metabase Unauthenticated SQL Injection
## CVE Details
- **CVE ID:** GHSA-vwf4-m7j8-wcjf (Note: At the time of reporting, the specific CVE-YYYY-XXXXX identifier is linked to this GitHub Advisory).
- **CVSS Score:** 10.0 (Critical - estimated based on unauthenticated RCE potential/SQLi)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** Metabase (Self-hosted and Cloud)
- **Versions:** 1.58.x prior to 1.58.24
- **Configurations:** Systems where the `/api/session/reset_password` endpoint is accessible.
## Vulnerability Description
The flaw is a SQL Injection vulnerability residing in the password reset API endpoint. It stems from a combination of three factors:
1. **Improper Input Handling:** The `merge` function in Clojure combines the incoming JSON request map with authentication results without stripping unexpected keys.
2. **Parameter Injection:** An attacker can provide a hidden `user-id` key in the JSON body of a password reset request. If authentication fails, the attacker-supplied `user-id` remains in the data map.
3. **HoneySQL `:raw` Feature:** The application uses the HoneySQL library. By passing a nested JSON object such as `{"user-id": {"raw": "SQL_QUERY_HERE"}}`, the attacker triggers the `:raw` keyword functionality, which embeds literal, unparameterized SQL strings directly into the database query.
## Exploitation
- **Status:** **Exploited in the wild.** Public Proof-of-Concept (PoC) exploits are available as of August 10, 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Remote, unauthenticated)
## Impact
- **Confidentiality:** Total (Full database access)
- **Integrity:** Total (Ability to modify or delete data)
- **Availability:** Total (Potential for database destruction or service disruption)
## Remediation
### Patches
Metabase has released fixed versions. Users should upgrade immediately to:
- **Metabase v0.58.24** or higher (for open-source editions)
- **Metabase v1.58.24** or higher (for enterprise editions)
### Workarounds
- Block public access to the `/api/session/reset_password` endpoint at the WAF or Reverse Proxy level.
- Restrict Metabase access to internal trusted networks/VPNs.
## Detection
- **Indicators of Compromise:** Look for unusual POST requests to `/api/session/reset_password` containing unexpected JSON keys (specifically `user-id`) or strings containing the `:raw` keyword.
- **Detection Methods:**
- Review application logs for "non-positive-int :user-id" warnings (in patched versions indicating failed attempts).
- Scan for vulnerable instances using security posture management tools (Wiz reports ~13% of cloud environments host Metabase).
## References
- [Metabase Security Advisory] hxxps://github[.]com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
- [Metabase Security Update Blog] hxxps://www[.]metabase[.]com/blog/security-update
- [Wiz Research Technical Analysis] hxxps://www[.]wiz[.]io/blog/inside-the-metabase-sqli-exploited-in-the-wild