Metabase Zero-Day Exploited: Unauthenticated Admin Access

Critical Metabase Zero-Day Under Active Exploitation

Metabase, a popular business intelligence and data visualization platform, has issued an urgent warning regarding a critical zero-day vulnerability actively exploited in the wild. This flaw, which currently lacks a CVE identifier, enables unauthenticated remote attackers to achieve administrator access to Metabase instances, posing a severe risk of data compromise.

According to The Hacker News, the vulnerability carries a maximum CVSS score of 10.0, underscoring its extreme severity. It specifically permits an attacker to inject arbitrary SQL commands into the Metabase application database. This unauthorized SQL injection ultimately grants them administrator privileges within the Metabase instance.

Metabase Unauthenticated SQL Injection Vulnerability: Technical Details

Upon gaining elevated administrator access, attackers can perform a range of highly damaging actions. These include altering application configurations, exfiltrating stored credentials for any connected databases, reading sensitive data accessible through these connections, and exporting data. The primary mechanism for this compromise is an unauthenticated SQL injection. Metabase explicitly stated, “We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (‘0-day’) security vulnerability in versions 1.58 and above.”

Organizations running self-hosted Metabase versions 1.58 and above are primarily at risk, as Metabase Cloud instances have already been updated to address the vulnerability. The active exploitation highlights the urgency for immediate remediation actions.

Real-World Impact and Indicators of Compromise

The real-world consequences of this zero-day are already apparent. PC manufacturer Framework, a user of Metabase, publicly disclosed a data breach resulting from this exploitation. Framework alerted its customers that personal information, including names, login IP addresses, physical addresses, phone numbers, and email addresses, was accessed during the incident. Importantly, Framework noted that no order or payment information was compromised.

Defenders seeking how to detect Metabase zero-day exploitation should scrutinize their application and server ingress logs for specific indicators of compromise (IoCs) shared by Metabase. While Metabase has not provided granular details about the malicious activity, the presence of the specified patterns in logs is a strong indication of a compromised instance. Metabase CEO Sameer Al-Sakran stated, “If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.”

This incident is not the first time Metabase has faced severe security challenges. Exactly three years prior, the company addressed another “extremely severe” flaw, CVE-2023-38646, which had a CVSS score of 9.8 and could have led to pre-authenticated remote code execution (RCE) on affected installations.

Actionable Recommendations and Mitigations

Given the active exploitation and critical severity, immediate action is paramount for all users of self-hosted Metabase instances:

• Apply Security Patches Immediately: Users are strongly advised to apply the latest security patches released by Metabase with immediate effect. This is the most comprehensive and recommended long-term solution.
• Temporary Workaround: Until patches can be fully applied, organizations should implement a temporary workaround by blocking public access to the /api/session/reset_password endpoint.
• Post-Update Steps: After applying the update, for customers who had their /api/session/reset_password endpoint publicly accessible, Metabase advises performing additional security steps to ensure integrity. While the specific steps were not detailed in the source, this suggests a need for verification of user accounts and configuration.
• Log Review: Proactively review application logs and Metabase server ingress logs for any signs of the shared IoCs to identify potential compromise.

Related: Metabase SQLi Zero-Day Exploited: Data Theft Attacks Confirmed, Nissan Breach: Oracle PeopleSoft Zero-Day Exploited by ShinyHunters