Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Metabase BI software
Incident: Zero-day SQL injection exploit leading to unauthorized administrative access.
Impact: Full system compromise, theft of database credentials, and unauthorized data exfiltration.
Attacker: Unidentified threat actors
Analysis: The flaw allows unauthenticated remote attackers to perform SQL injection, leading to full administrative takeover of Metabase instances. Attackers can pivot from this access to steal credentials for connected databases and export sensitive organizational data. The exploitation pattern is characterized by a specific sequence of API calls targeting password resets and user status.
Recommendations: Update Metabase to the latest patched version immediately to remediate the vulnerability.; Block the ‘/api/session/reset_password’ endpoint as a temporary workaround if patching is delayed.; Audit logs for a POST request to ‘/api/session/reset_password’ returning a 400 followed by a GET to ‘/api/user/current’ returning a 200.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source