Metabase, a prominent provider of data analytics solutions, has issued urgent updates to address a severe SQL injection vulnerability. This flaw has been actively exploited as a zero-day, posing significant risks to users.
Understanding the Vulnerability
The identified security issue permits remote, unauthorized attackers to execute arbitrary SQL queries within the Metabase application database. Such breaches can lead to administrative access, enabling attackers to alter application configurations, extract stored credentials for connected databases, and access or export data.
Although the vulnerability has not been assigned a CVE identifier, Metabase’s advisory highlighted that the flaw was discovered following its exploitation in a zero-day attack specifically targeting Metabase Cloud.
Immediate Actions Taken
In response to the threat, Metabase promptly blocked the vulnerable endpoints and swiftly developed a patch to rectify the issue. Metabase Cloud instances have already been updated with the necessary patches. However, users hosting Metabase on their own servers are strongly urged to apply these patches immediately to safeguard their systems.
For instances where patching cannot be done promptly, Metabase advises blocking the /api/session/reset_password endpoint as a temporary measure.
Steps for Enhanced Security
Metabase has provided comprehensive guidelines for users to enhance their security postures. This includes applying the latest patches, revoking active user sessions, reviewing and managing API keys, assessing administrative accounts, rotating credentials for all connected databases, and scrutinizing logs for unusual activity.
To detect potential breaches, users should examine logs for a “POST /api/session/reset_password” request returning a ‘400’ status code followed by a “GET /api/user/current” request with a ‘200’ status code. The presence of this pattern suggests a likely compromise.
Users are encouraged to update to versions 63.5, 62.9, 61.11, 60.17, 59.21, or 58.24 of Metabase, which contain the necessary security patches.
This incident underscores the critical need for timely updates and vigilant monitoring to protect against evolving cybersecurity threats.
