Metabase has issued a warning concerning a severe security flaw within its business intelligence and data visualization software, which has been actively exploited as a zero-day vulnerability. This flaw, assigned a CVSS score of 10.0, allows remote attackers to execute unauthorized SQL commands, gaining administrator access to the application database.
Understanding the Vulnerability
The vulnerability, not yet assigned a CVE identifier, permits attackers to inject arbitrary SQL into the Metabase system. This breach facilitates unauthorized access, enabling attackers to alter configurations, steal credentials, and export data from connected databases.
In an official advisory, Metabase revealed that versions 1.58 and above of its Cloud service experienced attacks exploiting this unknown security loophole. Immediate updates have been applied to Metabase Cloud instances, and users of self-hosted versions are strongly urged to implement the latest security patches.
Affected Versions and Mitigation Steps
The affected Metabase versions range from x.58.0 to x.63.3, with fixes available starting from versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. As an interim measure, it is recommended to block the “/api/session/reset_password” endpoint until the patch is applied.
Post-update, Metabase advises users to revoke all active sessions, inspect API keys, scrutinize administrator accounts, rotate database credentials, and monitor logs for unauthorized access.
Indicators of Compromise and Impact
While specific details of the attack remain undisclosed, Metabase has provided indicators of compromise (IoCs). A typical sign includes a “POST /api/session/reset_password” request with a 400 status code, followed by a “GET /api/user/current” with a 200 status code. If these patterns appear in logs, it may indicate a compromised system.
One notable victim, Framework, a PC manufacturer, reported a breach affecting customer data, including names, IP addresses, and contact details. However, no payment information was accessed.
Three years prior, Metabase addressed another severe flaw (CVE-2023-38646) with a CVSS score of 9.8, highlighting the ongoing challenges in securing software systems against unauthorized access.
It is imperative for Metabase users to prioritize these security updates to safeguard their systems and data from potential exploitation.
