open-metadata OpenMetadata up to 1.2.3 condition validateExpression os command injection

Summaryinfo

A vulnerability marked as critical has been reported in open-metadata OpenMetadata up to 1.2.3. This affects the function AlertUtil::validateExpression of the file /api/v1/events/subscriptions/validation/condition/. Performing a manipulation results in os command injection. This vulnerability is known as CVE-2024-28254. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in open-metadata OpenMetadata up to 1.2.3. This affects the function AlertUtil::validateExpression of the file /api/v1/events/subscriptions/validation/condition/. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-28254 since 03/07/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The exploit is shared for download at packetstormsecurity.com. It is declared as highly functional.

Upgrading to version 1.2.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• open-metadata

Name

• OpenMetadata

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3

Website

• Product: https://github.com/open-metadata/OpenMetadata/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion