Latest / The Digital Warfare Podcast / EP. 144: The Metabase Zero-Day That Turns Analytics Into a Database Attack Path
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we are covering an actively exploited vulnerability in Metabase that turns a business intelligence platform into a direct path toward administrator access and potentially every database connected behind it. And the key issue is not simply SQL injection, it is trust concentration. Metabase exists to connect organizations to their data. That means it often holds credentials for some of the most valuable databases inside the business. Here's what happened. A critical vulnerability is being tracked as GHSA-VWF4-M7J8-WCJF. At the time of this briefing, it does not yet have a CVE identifier. The vulnerability carries a maximum C VSS score of 10.0. It affects an unauthenticated password reset endpoint inside Metabase. An attacker can send specially crafted input to that endpoint and inject arbitrary SQL directly into the Metabase application database. No account is required, no user interaction is required, and attack complexity is considered low. Once the SQL injection succeeds, the attacker may be able to modify application configuration and obtain administrator level access to the Metabase instance. But that is only the beginning. Metabase frequently stores credentials required to connect to business databases. An attacker with administrative control may therefore obtain those stored credentials, access connected data sources. Read information available through those connections and export it. That turns a vulnerability in an analytics platform into a potential bridge toward customer records, operational data, financial information, internal reporting, and other sensitive business systems. The vendor has confirmed that the vulnerability is being actively exploited. Affected versions span multiple release branches. For the X.58 branch, versions from X.58.0 through X.58.22 are affected. For X.59 versions through X.59.19, for X.60 through X point six zero point one five, for X point six one through X point six one point nine, for X point six two through X point six two point seven, and for X point six three through X point six three point two. Fixed releases include X.58.24, X.59.21, X.60.17, X.61.11, X dot sixty two dot nine. XXX1 And X.63.5. Organizations should upgrade immediately. If that cannot happen, the temporary mitigation is to block access to the slash API slash session slash reset underscore password endpoint. But this is not a patch and forget incident. If that endpoint was publicly accessible, assume the environment requires investigation, revoke active user sessions, review API keys, audit administrator accounts, rotate credentials for every connected database, examine data warehouse logs. And review metabase query history for activity that does not belong. The most important defensive lesson is architectural. Analytics platforms are often treated as reporting tools. In reality, they are privileged data access systems. They sit between users and the databases containing the organization's most sensitive information. The strategic lesson is direct. When one application holds credentials to many data sources, compromise does not stop at the application boundary. It inherits the trust behind it. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.