Metabase, a business intelligence software provider, has disclosed that a critical SQL injection vulnerability, previously unknown, was exploited in zero-day attacks to compromise customer instances and steal data. The company confirmed that its Metabase Cloud SaaS platform was affected, and self-hosted installations running versions 1.58 and above were also vulnerable.
The vulnerability, which has a CVSS score of 10.0, is an unauthenticated SQL injection flaw. It allowed remote attackers to inject arbitrary SQL into the Metabase application database, ultimately granting them administrator access to the instance. With this level of access, attackers could alter application configurations, steal stored credentials for connected databases, access any data available through those connections, and export data.
Metabase CEO Sameer Al-Sakran stated that the company identified the attack on Metabase Cloud and promptly blocked the exploited endpoints before rolling out a fix. For Metabase Cloud customers, the necessary upgrades and patches have already been applied. However, organizations using self-hosted installations must manually update their systems.
The SQL injection vulnerability has been addressed in patched versions across all affected branches from 0.58 through 0.63. The minimum safe releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. For organizations unable to upgrade immediately, Metabase advises temporarily blocking access to the `/api/session/reset_password` endpoint until the update can be implemented.
Metabase recommends that self-hosted customers take several immediate actions: upgrade to a patched version, revoke all active user sessions, review API keys and administrator accounts for any unauthorized modifications, rotate credentials for all connected databases, and meticulously inspect logs and query history for signs of compromise. The company noted that potential attacks can be identified by a POST request to `/api/session/reset_password` that returns a 400 status code, followed by a successful GET request to `/api/user/current`. System logs displaying these entries likely indicate a compromise.
Several companies have confirmed that their Metabase instances were compromised as a result of this zero-day exploitation. Laptop manufacturer Framework notified its customers that their information was stolen after attackers accessed its Metabase instance. Framework stated that Metabase informed them on August 6 that their instance had been vulnerable and accessed on August 3. The stolen data includes full names, email addresses, login IP addresses, billing and shipping address details, phone numbers, and company names. For Framework for Business customers, additional data such as VAT, EIN, and billing email addresses may also have been exposed.
Online form builder Tally also informed its users that its Metabase analytics environment was compromised on August 3. Tally confirmed that attackers gained access to email addresses and password hashes, which are one-way cryptographic hashes and cannot be reversed into original passwords. The company stated that user forms and submitted answers were stored separately and were not accessed.
LexisNexis, a provider of legal and business information, has also warned customers about a cyberattack impacting one of its third-party vendors. While LexisNexis did not explicitly name Metabase, it confirmed that its Metabase API was affected. The company identified unusual activity on servers hosted and managed by a third-party vendor earlier in the week and disconnected from those systems to contain the issue, which caused service disruptions to applications like Diligence, Metabase API, and Newsdesk. LexisNexis is currently working with a cybersecurity forensic firm to investigate the incident and determine if customer data was exposed.
