Threat Intelligence Brief
Curated summary with source attribution
Source: teiss.co.uk
Threat Risk: Medium
Victim: Hardware Manufacturers / Metabase Users
Incident: Exploitation of a Metabase zero-day leading to a data breach of customer contact records.
Impact: Exposure of PII including names, emails, phone numbers, and shipping addresses for all customers.
Attacker: Unidentified threat actors
Analysis: Attackers leveraged a zero-day vulnerability in Metabase’s password-reset mechanism to perform SQL injection. This granted them administrator-level access to databases, allowing the theft of customer contact and billing information. The vulnerability affected both cloud and on-premise installations of Metabase version 1.58 and later.
Recommendations: Update Metabase installations to the latest patched version immediately.; Audit third-party analytics integrations to implement strict column-level data restrictions.; Alert users to remain vigilant against phishing attempts utilizing leaked contact information.
Source: teiss.co.uk
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source