Quick Takeaways
- Attackers exploited a zero-day SQL injection vulnerability in Metabase (versions 1.58+), allowing unauthorized remote access with administrator privileges, leading to data theft and configuration manipulation.
- The breach involved unauthorized API calls ("POST /api/session/reset_password" followed by "GET /api/user/current"), enabling session resets and administrator account access.
- Affected organizations, such as Framework, faced exposure of sensitive customer data, including names, IPs, and contact info, highlighting a significant risk of data breach and credential compromise.
Threat Overview, Attack Techniques, and Targets
Metabase has identified a high-severity security flaw in its business intelligence and data visualization software. This flaw is rated with a CVSS score of 10.0 and does not have a CVE identifier. It has been exploited in the wild as a zero-day, meaning attackers are actively using it before any patch is available.
The vulnerability allows an attacker to inject malicious SQL into the application’s database without needing to authenticate. This can let the attacker gain administrator access to the instance. Once they have this access, they can change application settings, steal stored database credentials, access data through connected databases, and export information.
Metabase confirmed that Cloud instances were attacked using this zero-day vulnerability. For versions 1.58 and above, attackers are exploiting this flaw. The affected versions include several ranges, with fixes released in newer versions. This attack mainly targets Metabase’s application servers, especially self-hosted versions.
Impact, Security Implications, and Remediation Guidance
The exploitation of this flaw has significant consequences. Attackers can gain full control over the Metabase environment. They can access sensitive data, change configurations, and potentially compromise connected data sources. This can cause data theft, data loss, and system damage.
The security implications are serious because the attack involves unauthenticated access, which makes it easier for attackers to break into systems. Additionally, once inside, they can perform activities that are normally protected by user authentication.
To reduce the risk, it is very important to update Metabase to the latest patched versions. The affected versions are listed in the advisory, and users are advised to apply the security patches immediately. As a temporary measure, blocking the “/api/session/reset_password” endpoint can help prevent some attack attempts.
If a system has been compromised, Metabase recommends actions such as revoking all active sessions, reviewing API keys and administrator accounts, rotating database credentials, and checking logs for abnormal activity. Because specific remediation steps depend on your environment, it is best to seek guidance from the vendor or relevant security authorities for detailed instructions.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
