Threat Intelligence Brief
Curated summary with source attribution
Source: metabase.com
Threat Risk: High
Victim: Metabase self-hosted users
Incident: Exploitation of a 0-day SQL injection vulnerability in Metabase.
Impact: Full administrative takeover of the Metabase instance and potential theft of connected database credentials and data.
Attacker: Unidentified threat actors
Analysis: Threat actors exploited a 0-day vulnerability in Metabase versions 0.58 and above to perform arbitrary SQL injection against the application database. Successful exploitation allows attackers to escalate privileges to administrator, steal database credentials, and exfiltrate sensitive data. The attack is characterized by a specific sequence of API requests to the password reset and current user endpoints.
Recommendations: Immediately upgrade Metabase to the latest available point release for your version.; Audit server logs for POST requests to /api/session/reset_password (400) followed by GET requests to /api/user/current (200).; Temporarily block access to the /api/session/reset_password endpoint if an immediate upgrade is not feasible.
Source: Metabase
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source