Full Report
Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain
Analysis Summary
# Vulnerability: Metabase Unauthenticated SQL Injection Zero-Day
## CVE Details
- **CVE ID:** None assigned (Zero-day)
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** Metabase Business Intelligence and Data Visualization software.
- **Versions:**
- Version 1.58.0 and above.
- Specifically: x.58.0, x.59.0, x.60.0, x.61.0, x.62.0.
- All versions less than x.63.5.
- **Configurations:** Self-hosted instances are at highest risk; Metabase Cloud instances have been patched by the vendor.
## Vulnerability Description
The flaw is a pre-authentication SQL injection vulnerability. An unauthenticated remote attacker can inject arbitrary SQL commands into the Metabase application database. This allows the attacker to bypass authentication mechanisms to gain full administrator access. Once administrative control is established, attackers can modify application settings, extract stored credentials for connected data sources, and exfiltrate data from linked data warehouses.
## Exploitation
- **Status:** Exploited in the wild as a zero-day.
- **Complexity:** Low (Targeting a specific API endpoint).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to application database and connected data sources).
- **Integrity:** High (Ability to modify configurations and user sessions).
- **Availability:** High (Potential for total system compromise).
## Remediation
### Patches
- Update to **Metabase version x.63.5** or higher immediately.
- (Metabase Cloud users require no action as they were updated automatically).
### Workarounds
- **Endpoint Blocking:** Immediately block all public access to the `POST /api/session/reset_password` endpoint at the firewall or reverse proxy level until patching is complete.
## Detection
### Indicators of Compromise (IoC)
The following log sequence indicates a likely compromise:
1. `POST /api/session/reset_password` returning a **400** status code.
2. Followed immediately by `GET /api/user/current` returning a **200** status code.
### Post-Exploitation Mitigation Steps
If signs of compromise are found:
- Revoke all active user sessions by deleting all rows in the `core_session` table in the application database.
- Inspect and delete any unrecognized API keys.
- Review administrator accounts for unauthorized additions.
- **Rotate credentials** for all databases connected to Metabase.
- Audit data warehouse logs and Metabase query history for unauthorized data access.
## References
- Metabase Security Advisory: hxxps[://]www[.]metabase[.]com/blog/security-update
- GitHub Advisory: hxxps[://]github[.]com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
- Framework Data Breach Notice: hxxps[://]www[.]engadget[.]com/2232708/framework-customer-information-was-accessed-as-part-of-a-data-breach/