Metabase Zero-Day SQL Injection Used in Customer Data-Theft Attacks
Summary
Metabase confirmed active exploitation of a critical unauthenticated SQL injection flaw. Framework confirmed customer data theft; Tally reported exposed emails and password hashes, while LexisNexis said exposure remains unclear. Patches and mitigations are available.
Key points
- Metabase confirmed active exploitation of a critical unauthenticated SQL injection flaw that could grant attackers administrator access.
- Metabase Cloud was attacked; self-hosted installations were also vulnerable. The flaw affected versions 1.58 and later.
- Framework confirmed attackers stole customer information, including contact, login, billing, and shipping details.
- Tally reported that attackers accessed users’ email addresses and password hashes, but not forms or submitted answers.
- LexisNexis reported an attack affecting its Metabase API through a third-party vendor; whether customer data was exposed remains unclear.
- Metabase released fixes for affected branches and advises self-hosted customers to upgrade, revoke sessions, review accounts and logs, and rotate connected-database credentials.
- Metabase said a POST to /api/session/reset_password returning 400, followed by a successful GET to /api/user/current, can indicate compromise.
Article Details
- Vulnerability Types
- Unauthenticated SQL injection
- Severity
- Critical; CVSS 10.0
- Affected Versions
- Metabase versions 1.58 and above
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Temporarily block access to the /api/session/reset_password endpoint until the update can be applied.
MITRE ATT&CK
People
Vendors
Products
MetabaseA critical unauthenticated SQL injection flaw in Metabase was actively exploited as a zero-day, giving attackers administrator access to customer instances and enabling data theft from both Metabase Cloud andMetabase Cloudgiving attackers administrator access to customer instances and enabling data theft from both Metabase Cloud and self-hosted deployments.