Metabase Zero-Day Exploited in Wild, Granting Unauthenticated Admin Access
A critical zero-day vulnerability in Metabase, rated CVSS 10.0, is being actively exploited in the wild, allowing unauthenticated attackers to gain administrative control.
Metabase, a popular open-source business intelligence and data visualization platform, has issued a stark warning regarding a critical zero-day vulnerability that is already being exploited by attackers. The flaw, which carries the maximum CVSS score of 10.0 and does not yet have an assigned CVE identifier, allows unauthenticated remote attackers to inject arbitrary SQL commands directly into the Metabase application database.
This SQL injection capability is particularly dangerous as it bypasses all authentication mechanisms, granting attackers immediate administrative access to the compromised Metabase instance. With this elevated privilege, threat actors can perform a wide range of malicious actions. These include altering the application's configuration settings, exfiltrating stored credentials for connected databases, accessing any data accessible through those connections, and even exporting sensitive data from the environment.
Metabase confirmed that its own cloud-hosted instances were targeted by attackers leveraging this unknown vulnerability. The company has since updated its Metabase Cloud instances to the latest patched version. For users running self-hosted deployments, Metabase strongly advises immediate patching to mitigate the risk. The vulnerability affects several version ranges, with specific fixes available in versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5.
As a temporary workaround for those unable to patch immediately, Metabase recommends blocking access to the "/api/session/reset_password" endpoint. Once systems are updated, customers with publicly accessible "/api/session/reset_password" endpoints are urged to take further protective measures. These include revoking all active user sessions by clearing the core_session table in the Metabase Application Database, reviewing and deleting any unrecognized API keys, scrutinizing administrator accounts for unauthorized additions, rotating credentials for all connected databases, and thoroughly reviewing data warehouse logs for signs of intrusion.
Metabase has provided specific indicators of compromise (IoCs) to help organizations detect if their instances have been affected. The presence of a "POST /api/session/reset_password" request resulting in a 400 status code, immediately followed by a "GET /api/user/current" request with a 200 status code, in application or server ingress logs is a strong indicator of a compromise. Metabase CEO Sameer Al-Sakran emphasized that finding this pattern suggests a likely breach.
One confirmed victim of this attack is Framework, a PC manufacturer. The company alerted its customers that their names, login IP addresses, physical addresses, phone numbers, and email addresses were accessed during the incident. Fortunately, Framework stated that no order or payment information was compromised. This incident highlights the broad impact of such vulnerabilities, extending beyond technical infrastructure to sensitive customer data.
The severity of this zero-day is underscored by its timing and impact. It follows a previous "extremely severe" flaw in Metabase (CVE-2023-38646) that was patched approximately three years ago, which also carried a high CVSS score and posed a significant remote code execution risk. The ongoing exploitation of such critical vulnerabilities in widely used platforms like Metabase underscores the persistent threat landscape and the critical need for rapid patching and robust security monitoring.
This new report details the specific attack vector, an unauthenticated SQL injection in the POST /api/session/reset_password endpoint, which allows attackers to manipulate database records and promote themselves to administrator. It also provides a distinctive log signature for detection: a 400 status code on the reset password endpoint followed by a 200 status code on GET /api/user/current. Furthermore, the article highlights that Metabase Cloud customers were automatically protected, while self-hosted deployments require immediate manual patching to versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5.
Framework, a modular laptop maker, has disclosed that all of its customers were impacted by a data breach originating from a zero-day exploit in Metabase, their analytics provider. The attackers gained access to customer names, emails, phone numbers, physical addresses, and login IPs, with business clients also having company names, VAT/EIN numbers, and billing emails exposed. While order and payment details were unaffected, Framework is reviewing its data storage practices with external vendors and notifying regulators.
Metabase has released specific patch versions for this critical vulnerability, including versions 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24. For organizations unable to patch immediately, Metabase advises blocking the /api/session/reset_password endpoint as a temporary mitigation. The advisory also details specific log patterns to identify potential compromises, such as a POST to /api/session/reset_password followed by a GET to /api/user/current.
This new report details that the Metabase zero-day vulnerability has also impacted other companies, including Tally, a Belgian form-building platform, and Kilo Code, an AI coding platform. Tally reported that attackers accessed customer email addresses and password hashes, while Kilo Code noted the compromise of names, emails, and customer Slack access tokens. Framework confirmed that payment information and order records were not accessed, but advised customers to watch for phishing attempts.
This new report from Dark Reading indicates that the unpatched SQL zero-day vulnerability in Metabase, which allows for remote, unauthenticated administrator access, could have a wide blast radius. The article emphasizes that the vulnerability has not yet been assigned a CVE ID, highlighting the urgency for users to secure their deployments.