Attackers have exploited a zero-day vulnerability in Metabase, an open-source business intelligence and data analytics platform, to gain administrative access and steal sensitive data. The flaw, which carries a maximum CVSS score of 10.0, allowed unauthenticated attackers to inject arbitrary SQL into the Metabase application database.
Metabase confirmed that its cloud service was targeted using this previously unknown vulnerability in versions 1.58 and above. The company detected the attack, blocked the exploited endpoints, and patched the flaw, ensuring that Metabase Cloud instances were updated before a public advisory was released.
However, self-hosted Metabase deployments remain vulnerable if not updated. The affected versions range from 0.58 through 0.63. Specific patched point releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Users running versions 0.57 or earlier are not affected.
Once an attacker gained access, they could achieve administrator rights over the Metabase instance. This level of access allowed them to modify application configurations, exfiltrate stored credentials for all connected databases, read any data accessible through those connections, and export that data. Given that Metabase typically connects to a company's most sensitive data warehouses, this represents a significant security breach.
As a temporary mitigation for self-hosted instances that cannot be immediately updated, Metabase recommends blocking the `/api/session/reset_password` endpoint at the network level.
Metabase also provided an attack signature for organizations to check their logs. A sequence involving a `POST` call to `/api/session/reset_password` resulting in a 400 status code, immediately followed by a `GET` call to `/api/user/current` with a 200 status code, indicates a likely compromise. If this pattern is found in application or ingress logs, the instance should be treated as breached.
For compromised instances, Metabase advises a comprehensive cleanup. This includes clearing all active sessions by wiping the `core_session` table, auditing API keys for any unauthorized additions, checking administrator accounts for unexpected changes, rotating credentials for every connected database, and reviewing both data warehouse logs and Metabase's query history for suspicious activity.
PC manufacturer Framework has confirmed it was a victim of this zero-day exploit. The company notified its customers that personal information, including names, login IP addresses, physical addresses, phone numbers, and email addresses, was accessed. Framework stated that no order or payment information was compromised.
The exploitation of this vulnerability as a genuine zero-day means that attackers discovered and utilized the flaw before Metabase was aware of its existence, with the company only learning of it through attacks on its own cloud infrastructure.
