Horizon Alert
Summary of the vulnerability and why it matters
Metabase, an open-source data analytics platform, has a security flaw related to its custom map feature. This weakness allows unauthorized access to local files, including environment variables, by not properly validating URLs. The potential impact includes unauthorized data exposure, affecting the confidentiality of sensitive information.
- Vulnerable component: Custom map feature
- Core weakness: Unvalidated URLs
- Main business impact: Data exposure
Attack Path
How an attacker could exploit the issue
This vulnerability in the Metabase analytics platform allows an attacker to access sensitive files on the server. The attack involves manipulating URLs within the custom map feature to read arbitrary files, including environment variables. This could expose system configurations and credentials to the attacker.
- Publicly accessible Metabase instance.
- Attacker sends malicious URL.
- Attacker accesses local files.
Live Threat
Current exploitation, exposure, and threat context
Metabase, an open-source data analytics platform, experienced a security vulnerability that allowed for the inclusion of local files. This could expose environment variables and sensitive data. The issue was addressed in maintenance releases starting with version 0.40.5 and 1.40.5. Organizations unable to immediately upgrade can implement mitigation rules in their reverse proxy, load balancer, or Web Application Firewall to validate URLs before they reach the application.
- Attackers with low skill.
- No prior access needed.
- High business risk.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
A security vulnerability in Metabase, a data analytics platform, could allow unauthorized access to local files. This is due to how the custom GeoJSON map feature handles URLs. This issue poses a business risk by potentially exposing sensitive information.
- Identify Metabase instances and their configurations.
- Isolate affected systems or implement proxy/WAF rules.
- Apply the vendor fix, verify, and monitor.
