Metabase, a popular open-source platform for business intelligence and data visualization, has been compromised by a significant zero-day vulnerability. This flaw, identified as GHSA-vwf4-m7j8-wcjf, has been actively exploited, allowing attackers to gain full administrative control over affected systems without authentication.
Details of the Metabase Vulnerability
The vulnerability in question is an SQL injection flaw with a maximum CVSS score of 10.0, affecting versions 1.58 and later, covering branches 0.58 to 0.63. Although lacking a CVE identifier, its severity and active exploitation classify it as one of the year’s most critical vulnerabilities in business intelligence platforms.
The issue resides in the publicly accessible POST /api/session/reset_password endpoint. Attackers can inject SQL commands directly into Metabase’s database without needing to log in, enabling them to elevate their privileges to an administrator level and take control of the instance.
Impact and Exploitation
Once attackers achieve administrative access, they can modify configuration settings, extract stored database credentials, access connected data, and export sensitive information freely. The vulnerability was first exploited on August 3, when Metabase’s Cloud SaaS platform was compromised, prompting the company to block the malicious endpoints and release a patch.
While Metabase Cloud customers received an automatic update, self-hosted instances are still at risk until administrators apply the necessary patch. Data breaches have been reported by companies like Framework and Tally, resulting in unauthorized access to customer data such as names, addresses, phone numbers, and emails.
Steps for Mitigation
Administrators are urged to look for a specific attack pattern in server logs: a POST /api/session/reset_password call returning a 400 status code, followed by a GET /api/user/current call returning a 200 status code. This indicates a successful exploitation, and such instances should be treated as compromised.
Immediate upgrades to the patched versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 are crucial for self-hosted Metabase. Security teams should revoke all active sessions, audit API keys, review administrator accounts for anomalies, rotate database credentials, and scrutinize query logs for unauthorized activities.
Given the central role of business intelligence tools like Metabase in organizational data ecosystems, a single SQL injection vulnerability poses a significant risk, potentially leading to widespread breaches across connected systems. Organizations should prioritize patching and assume compromise if indicative log patterns are detected.
Strengthen your security posture by integrating advanced threat detection tools to accelerate investigations and response times.
