Metabase, a widely-used business intelligence and data visualization platform, has disclosed a critical security vulnerability that has been actively exploited as a zero-day. This flaw, assigned a CVSS score of 10.0, enables unauthenticated remote attackers to execute arbitrary SQL commands within the Metabase application database, effectively granting them administrative privileges.
With such elevated access, malicious actors can alter application configurations, extract stored credentials for connected databases, access any data available through these connections, and export sensitive information. Metabase identified that its cloud service was targeted using this previously unknown vulnerability in versions 1.58 and later.
In response, Metabase has updated all cloud instances to the latest version. Users operating self-hosted versions are strongly advised to apply the security patches immediately. The affected versions and their corresponding fixes are as follows:
- Versions ≥ x.58.0 and < x.58.23 (Fixed in x.58.24)
- Versions ≥ x.59.0 and < x.59.20 (Fixed in x.59.21)
- Versions ≥ x.60.0 and < x.60.16 (Fixed in x.60.17)
- Versions ≥ x.61.0 and < x.61.10 (Fixed in x.61.11)
- Versions ≥ x.62.0 and < x.62.8 (Fixed in x.62.9)
- Versions ≥ x.63.0 and < x.63.3 (Fixed in x.63.5)
As an interim measure, administrators are advised to block the “/api/session/reset_password” endpoint until the patches are applied. After updating, it is recommended to:
- Revoke all active user sessions by deleting all rows in the core_session table of the Metabase Application Database.
- Review and delete any unrecognized API keys.
- Examine administrator accounts for unauthorized changes.
- Rotate credentials for all connected databases.
- Inspect data warehouse logs for signs of unauthorized access.
- Review Metabase activity and query history for any unexpected or unauthorized actions.
Indicators of compromise include a POST request to “/api/session/reset_password” resulting in a 400 status code, followed by a GET request to “/api/user/current” with a 200 status code. If such patterns are detected in application or server logs, it is likely that the instance has been compromised.
Notably, Framework, a PC manufacturer, reported that customer names, login IPs, addresses, phone numbers, and emails were accessed during the attack. However, order and payment information remained secure.
Three years prior, Metabase addressed another severe vulnerability (CVE-2023-38646) with a CVSS score of 9.8, which could have led to pre-authenticated remote code execution on affected installations.
This incident underscores the critical importance of promptly applying security patches and maintaining vigilant monitoring of system logs. Organizations must prioritize the security of their data visualization tools, as vulnerabilities in such platforms can serve as gateways to broader system compromises.
