Metabase Zero-Day Exploited in Wild, Granting Unauthenticated Admin Access
A critical zero-day vulnerability in Metabase, rated CVSS 10.0, is being actively exploited in the wild, allowing unauthenticated attackers to gain administrative control.
Metabase, a popular open-source business intelligence and data visualization platform, has issued a stark warning regarding a critical zero-day vulnerability that is already being exploited by attackers. The flaw, which carries the maximum CVSS score of 10.0 and does not yet have an assigned CVE identifier, allows unauthenticated remote attackers to inject arbitrary SQL commands directly into the Metabase application database.
This SQL injection capability is particularly dangerous as it bypasses all authentication mechanisms, granting attackers immediate administrative access to the compromised Metabase instance. With this elevated privilege, threat actors can perform a wide range of malicious actions. These include altering the application's configuration settings, exfiltrating stored credentials for connected databases, accessing any data accessible through those connections, and even exporting sensitive data from the environment.
Metabase confirmed that its own cloud-hosted instances were targeted by attackers leveraging this unknown vulnerability. The company has since updated its Metabase Cloud instances to the latest patched version. For users running self-hosted deployments, Metabase strongly advises immediate patching to mitigate the risk. The vulnerability affects several version ranges, with specific fixes available in versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5.
As a temporary workaround for those unable to patch immediately, Metabase recommends blocking access to the "/api/session/reset_password" endpoint. Once systems are updated, customers with publicly accessible "/api/session/reset_password" endpoints are urged to take further protective measures. These include revoking all active user sessions by clearing the core_session table in the Metabase Application Database, reviewing and deleting any unrecognized API keys, scrutinizing administrator accounts for unauthorized additions, rotating credentials for all connected databases, and thoroughly reviewing data warehouse logs for signs of intrusion.
Metabase has provided specific indicators of compromise (IoCs) to help organizations detect if their instances have been affected. The presence of a "POST /api/session/reset_password" request resulting in a 400 status code, immediately followed by a "GET /api/user/current" request with a 200 status code, in application or server ingress logs is a strong indicator of a compromise. Metabase CEO Sameer Al-Sakran emphasized that finding this pattern suggests a likely breach.
One confirmed victim of this attack is Framework, a PC manufacturer. The company alerted its customers that their names, login IP addresses, physical addresses, phone numbers, and email addresses were accessed during the incident. Fortunately, Framework stated that no order or payment information was compromised. This incident highlights the broad impact of such vulnerabilities, extending beyond technical infrastructure to sensitive customer data.
The severity of this zero-day is underscored by its timing and impact. It follows a previous "extremely severe" flaw in Metabase (CVE-2023-38646) that was patched approximately three years ago, which also carried a high CVSS score and posed a significant remote code execution risk. The ongoing exploitation of such critical vulnerabilities in widely used platforms like Metabase underscores the persistent threat landscape and the critical need for rapid patching and robust security monitoring.