CVE-2024-28847 in OpenMetadata
Summary
by MITRE • 03/15/2024
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and, therefore, after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/events/subscriptions` which gets handled by `EventSubscriptionResource.createOrUpdateEventSubscription()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-251`.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2025
The vulnerability identified as CVE-2024-28847 affects OpenMetadata, a unified metadata management platform that serves as a central repository for discovery, observability, and governance functionalities. This security flaw stems from improper handling of Spring Expression Language (SpEL) expressions within the platform's event subscription mechanism. The vulnerability manifests through a critical code execution path that bypasses authorization checks, creating a significant security risk for systems relying on this metadata platform. The issue is particularly concerning as it allows remote attackers to execute arbitrary code on affected systems without proper authentication, making it a severe threat to enterprise metadata infrastructure.
The technical implementation of this vulnerability occurs through a specific call chain that begins with the `EventSubscriptionResource.createOrUpdateEventSubscription()` method. This method processes PUT requests to the `/api/v1/events/subscriptions` endpoint, which subsequently invokes `EntityResource.createOrUpdate()`. The execution path continues through `EntityRepository.prepareInternal()` before reaching `EventSubscriptionRepository.prepare()`, where the `AlertUtil::validateExpression` method is called. This final step in the chain evaluates SpEL expressions without adequate input sanitization, creating an injection vector that attackers can exploit. The vulnerability is classified as a code injection flaw under CWE-94, specifically involving the execution of untrusted code through expression language evaluation.
The operational impact of CVE-2024-28847 extends beyond simple unauthorized access, as it enables full remote code execution capabilities that could compromise entire metadata repositories and underlying systems. Attackers exploiting this vulnerability could gain complete control over the OpenMetadata platform, potentially accessing sensitive data, modifying metadata structures, or using the compromised system as a pivot point for further attacks within the network. The timing of the authorization check, which occurs after the SpEL expression evaluation, creates a window where malicious code can execute before any access controls are enforced. This architectural flaw violates fundamental security principles and represents a critical design weakness in the platform's security model, particularly concerning the order of operations in request processing.
Mitigation strategies for this vulnerability require immediate action from affected organizations, as there are no known workarounds that can safely maintain system functionality while preserving the security of the platform. The recommended approach is to upgrade to OpenMetadata version 1.2.4, which contains the necessary patches to address the SpEL injection vulnerability. Security teams should also implement network-level restrictions to limit access to the vulnerable API endpoints, particularly the `/api/v1/events/subscriptions` path, until the upgrade is complete. Organizations should conduct thorough security assessments of their metadata repositories to identify any potential compromise, as the vulnerability could have been exploited to establish persistent access. Additionally, monitoring for suspicious API activity related to event subscription creation and modification should be implemented as part of incident response procedures.
This vulnerability aligns with ATT&CK techniques related to code injection and privilege escalation, specifically targeting the execution of malicious code through expression language processing. The attack pattern follows the typical methodology of exploiting insecure deserialization and expression evaluation mechanisms that are common in enterprise platforms. The fact that this issue was discovered using CodeQL's Expression language injection query highlights the importance of automated security analysis in identifying such vulnerabilities in complex software ecosystems. Organizations using OpenMetadata should also consider implementing additional security controls such as API rate limiting, enhanced logging of subscription creation events, and regular security scanning of their metadata platform to prevent similar vulnerabilities from being exploited in the future. The vulnerability demonstrates the critical importance of maintaining proper input validation and sanitization in enterprise software, particularly when dealing with dynamic expression evaluation mechanisms that can execute arbitrary code.