cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Metabase Zero-Day Exploited to Give Attackers Unauthenticated Admin Access

· Original article ↗

Summary

Metabase says a CVSS 10.0 zero-day enabled unauthenticated SQL injection and admin access. Cloud instances were updated; self-hosted users should patch and review logs. Framework reported customer contact data was accessed.

Key points

  • Metabase disclosed in-the-wild exploitation of a zero-day with a CVSS score of 10.0; no CVE identifier was provided.
  • The flaw reportedly allows unauthenticated attackers to inject SQL into the application database and gain administrator access.
  • Metabase Cloud instances were updated; affected self-hosted users were urged to install fixes for their versions.
  • As a temporary workaround, Metabase advised blocking the /api/session/reset_password endpoint.
  • Metabase advised reviewing sessions, API keys, administrator accounts, connected-database credentials, warehouse logs, and activity history.
  • Metabase identified a possible compromise pattern: POST /api/session/reset_password returning 400, followed by GET /api/user/current returning 200.
  • Framework reported that customer names, login IPs, addresses, phone numbers, and email addresses were accessed; it said order and payment information was not accessed.

Article Details

Vulnerability Types
  • Unauthenticated SQL injection
Severity
CVSS 10.0
Affected Versions
  • Metabase >= x.58.0 and < x.58.23
  • Metabase >= x.59.0 and < x.59.20
  • Metabase >= x.60.0 and < x.60.16
  • Metabase >= x.61.0 and < x.61.10
  • Metabase >= x.62.0 and < x.62.8
  • Metabase >= x.63.0 and < x.63.3
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Temporarily block the /api/session/reset_password endpoint until patches can be applied.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationUnauthenticated remote attackers exploited the Metabase vulnerability to inject SQL and gain administrator access.

People

Sameer Al-SakranMetabase CEO who described the API request pattern that may indicate an instance was compromised.

Vendors

MetabaseMetabase has disclosed that a maximum-severity zero-day in its business intelligence and data visualization software was exploited in the wild, allowing unauthenticated attackers to inject SQL and gain administrator

Products

MetabaseMetabase has disclosed that a maximum-severity zero-day in its business intelligence and data visualization software was exploited in the wild, allowing unauthenticated attackers to inject SQL and gain administratorMetabase CloudThe issue affected Metabase Cloud and self-hosted versions, with Framework confirming customer data exposure, while Metabase urged immediate patching and log review.

Industries

Business intelligenceMetabase has disclosed that a maximum-severity zero-day in its business intelligence and data visualization software was exploited in the wild, allowing unauthenticated attackers to inject SQL and gain administrator

Related Articles