CVE-2023-23628 in Metabase
Summary
by MITRE • 01/28/2023
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/23/2023
The vulnerability CVE-2023-23628 represents a critical access control flaw within the Metabase data analytics platform that violates fundamental security principles of data isolation and user privilege management. This issue specifically affects sandboxed user accounts that should operate under restricted permissions and be unable to access information about other users within the system. The vulnerability stems from improper authorization checks during dashboard subscription settings access, creating an information disclosure channel that allows unauthorized users to discover user membership lists. Such a flaw directly contravenes the core security tenets of least privilege and principle of least authority that are essential for maintaining data confidentiality and user privacy in enterprise analytics environments.
The technical implementation of this vulnerability occurs when a sandboxed user accesses the settings interface for any dashboard subscription that contains user recipient lists. Under normal circumstances, the system should enforce strict access controls preventing sandboxed users from viewing sensitive user information regardless of their role or access level. However, the flaw manifests in the application's permission validation logic where the system fails to properly verify user privileges before displaying recipient information. This creates a scenario where a user with limited access can indirectly obtain user enumeration data through legitimate application navigation paths, essentially bypassing the intended security boundaries that separate different user roles and their respective access rights.
The operational impact of this vulnerability extends beyond simple information disclosure, as it fundamentally undermines the security model of the Metabase platform and creates potential risks for organizations relying on user isolation for data protection. Attackers could leverage this vulnerability to map user populations within the system, potentially identifying key personnel, administrators, or stakeholders who have access to sensitive dashboards. This information gathering capability aligns with attack patterns described in the MITRE ATT&CK framework under T1087.001 (Account Discovery) and T1566 (Phishing for Information) where adversaries seek to understand system user structures to plan more sophisticated attacks. The vulnerability particularly affects organizations using Metabase for enterprise analytics where user isolation is critical for maintaining data governance and preventing unauthorized access to sensitive business intelligence.
From a compliance and security standards perspective, this vulnerability directly relates to CWE-284 (Improper Access Control) and CWE-200 (Information Exposure) which are commonly cited in security frameworks such as NIST SP 800-53 and ISO 27001. The flaw represents a failure in the application's authorization mechanism and violates fundamental security requirements for multi-tenant environments where user data isolation must be maintained. Organizations using Metabase in regulated environments may face compliance violations if user information is inadvertently exposed through such mechanisms. The vulnerability also demonstrates the importance of thorough security testing for web applications, particularly around privilege escalation and information disclosure scenarios that could occur through indirect access paths within complex user interfaces.
The mitigation strategy for this vulnerability requires immediate deployment of patched versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1 as there are no effective workarounds available. Security teams should conduct comprehensive audits of their Metabase installations to ensure all affected versions have been updated and verify that proper access controls are restored. Additionally, organizations should review their user access policies and implement monitoring for unusual access patterns that might indicate exploitation attempts. The vulnerability highlights the critical importance of regular security updates and the need for organizations to maintain current versions of open source software to protect against known vulnerabilities that could compromise user privacy and data integrity within their analytics platforms.