Metabase fixes exploited zero-day that can grant administrator access

Metabase has disclosed an actively exploited, maximum-severity zero-day in its business intelligence and data visualisation platform. The flaw has a CVSS score of 10.0 and lets an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database, then gain administrator access to an affected instance.

Metabase said its Cloud service was attacked through the previously unknown vulnerability in versions 1.58 and later. Cloud instances have been updated to the latest release, while organisations running self-hosted deployments have been urged to apply the available patches immediately.

Six release branches require attention

The vulnerability has no CVE identifier. It affects versions 1.58.0 through 1.58.23, fixed in 1.58.24; 1.59.0 through 1.59.20, fixed in 1.59.21; and 1.60.0 through 1.60.16, fixed in 1.60.17.

Also affected are versions 1.61.0 through 1.61.10, fixed in 1.61.11; 1.62.0 through 1.62.8, fixed in 1.62.9; and 1.63.0 through 1.63.3, fixed in 1.63.5. Until an update can be installed, Metabase advises administrators to block the /api/session/reset_password endpoint as a temporary workaround.

Administrator access expands the exposure

Control of a Metabase instance can allow an attacker to alter application configuration, obtain credentials stored for connected databases, read data available through those connections and export data. The incident illustrates how weaknesses that bypass authentication can turn an analytics platform into a route to underlying data services, a pattern that aligns with attacks that abuse established trust relationships and its focus on attacks that abuse established trust relationships.

Metabase provided a specific indicator of compromise: a POST /api/session/reset_password request returning HTTP 400, followed by a GET /api/user/current request returning HTTP 200. CEO Sameer Al-Sakran said that finding this sequence in application or server ingress logs likely indicates that an instance has been compromised.

Post-patch checks remain necessary

After patching, customers whose password-reset endpoint was publicly accessible should revoke active sessions by deleting rows from the core_session table in the Metabase Application Database. They should also review API keys and administrator accounts for unexpected changes, rotate credentials for connected databases, and inspect data-warehouse logs along with Metabase activity and query history.

Framework was among the affected companies. The PC maker said customer names, login IP addresses, postal addresses, phone numbers and email addresses were accessed, while order and payment information was not accessed.

For businesses, the immediate implication is to identify every self-hosted Metabase deployment, install the matching fixed release, and treat the published request sequence as a trigger for credential, session and data-access review.