Metabase, a widely adopted open-source business intelligence and data visualization platform, has disclosed a critical zero-day vulnerability, identified as GHSA-vwf4-m7j8-wcjf, which has been actively exploited in the wild. This flaw enables unauthenticated attackers to obtain full administrator access to affected instances.
The vulnerability, carrying a maximum CVSS score of 10.0, affects all releases from version 1.58 onward, specifically branches 0.58 through 0.63. It resides in the publicly accessible POST /api/session/reset_password endpoint, where an unauthenticated SQL injection flaw allows attackers to execute arbitrary SQL statements directly against the Metabase application database.
By exploiting this flaw, attackers can escalate their privileges to administrator level, granting them comprehensive control over the instance. This control includes the ability to modify application configurations, extract stored credentials for all databases connected to Metabase, access any data through these connections, and export sensitive records.
Metabase detected the exploitation of this vulnerability on August 3, when its own Metabase Cloud SaaS platform was compromised. The company promptly blocked the malicious endpoints and released a patch within hours, automatically upgrading and protecting all Metabase Cloud customers.
However, self-hosted deployments remain vulnerable until administrators apply the necessary fixes. Notably, companies such as Framework and Tally have reported unauthorized access to customer information, including names, addresses, phone numbers, and emails, as a result of this zero-day exploit.
Administrators can identify potential exploitation by examining web server or application logs for a specific pattern: a POST /api/session/reset_password request returning a 400 status code, immediately followed by a GET /api/user/current request returning a 200 status code. This sequence indicates a successful exploit, and any instance displaying these log entries should be considered compromised.
To mitigate this vulnerability, administrators of self-hosted Metabase instances should upgrade immediately to the minimum safe patched release for their respective branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. Versions prior to 0.58 are not affected by this specific flaw.
Additionally, if the password reset endpoint was publicly accessible before patching, it is recommended to revoke all active sessions by clearing the core_session table, audit API keys for any unrecognized entries, review administrator accounts for unexpected changes, rotate credentials for all connected databases, and scrutinize data warehouse and Metabase query logs for signs of unauthorized activity.
Business intelligence tools like Metabase often serve as central hubs within an organization’s data ecosystem, holding privileged credentials to multiple backend databases. Consequently, a single unauthenticated SQL injection flaw poses a significant risk, as compromising one BI instance can lead to a broader breach of connected systems.
Organizations utilizing self-hosted Metabase should prioritize patching this vulnerability urgently and assume potential compromise if the indicative log pattern is present within their infrastructure.
