CVE-2024-28255 in OpenMetadata
Summary
by MITRE • 03/15/2024
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2025
The vulnerability identified as CVE-2024-28255 affects OpenMetadata, a unified metadata platform designed for discovery, observability, and governance. This platform operates through a central metadata repository with lineage capabilities and collaborative features. The core authentication mechanism relies on the JwtFilter component which is responsible for validating JWT tokens for API requests. The filter maintains a list of excluded endpoints that bypass JWT validation, intended for public or unauthenticated access points within the system.
The technical flaw stems from improper path validation logic within the JwtFilter implementation. When processing incoming requests, the system checks if the request path contains any strings from the excluded endpoints list. However, the vulnerability arises from the lack of proper path sanitization and parameter validation. Attackers can exploit path parameters to manipulate the request path in a way that makes it appear to contain excluded endpoints while actually accessing different functionality. This manipulation occurs through URL encoding where path segments can be constructed to match excluded endpoint patterns while maintaining functional access to protected resources.
The operational impact of this vulnerability is significant as it allows attackers to bypass authentication mechanisms entirely. By crafting malicious requests that leverage path parameter manipulation, attackers can access protected endpoints that should require valid JWT tokens. The vulnerability specifically mentions that requests to paths like `/api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` can match excluded endpoint conditions and bypass validation. This creates a pathway for unauthorized access to sensitive functionality and potentially leads to arbitrary SpEL expression injection attacks, which could result in remote code execution or data compromise.
This vulnerability aligns with CWE-287, which addresses improper authentication issues, and represents a classic case of insecure input handling in authentication filters. The attack pattern follows techniques described in the MITRE ATT&CK framework under T1078 for valid accounts and T1190 for exploitation of vulnerabilities. The issue demonstrates a critical flaw in the principle of least privilege where the authentication system fails to properly validate that the intended endpoint is actually being accessed. The fact that this bypass does not work when endpoints use `SecurityContext.getUserPrincipal()` which returns null and throws NPE indicates that the vulnerability specifically targets the JwtFilter's path matching logic rather than the broader authentication framework.
The vulnerability has been addressed in OpenMetadata version 1.2.4, making upgrade the primary mitigation strategy. Organizations using affected versions should immediately plan and execute the upgrade process to protect their metadata platforms. No known workarounds exist for this specific vulnerability, as it fundamentally stems from the path validation logic within the authentication filter itself. The vulnerability is tracked as GHSL-2023-237, indicating it was recognized and addressed through GitHub Security Lab's vulnerability tracking process. Security teams should monitor their OpenMetadata deployments for any signs of exploitation attempts and implement network monitoring to detect malformed requests that attempt to leverage this path manipulation technique.