Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability impacts Metabase, a business intelligence platform, by allowing unauthenticated attackers to inject malicious SQL code. This could potentially grant unauthorized administrators access to the connected Metabase instance and its data.
- Attackers can insert malicious commands into password reset requests.
- Critical systems may face unauthorized access and data compromise.
- Confirm Metabase usage and assess exposure to sensitive data.
Attack Path
How an attacker could exploit the issue
An attacker can target the Metabase application's password reset feature to inject malicious SQL commands. By sending specially crafted input to the `/reset_password` endpoint, an unauthenticated user can manipulate the database queries, potentially gaining administrative control over the Metabase instance.
- No authentication required.
- Inject SQL via password reset.
- Gain administrator access.
Live Threat
Current exploitation, exposure, and threat context
A remote, unauthenticated attacker could inject arbitrary SQL via the password reset endpoint, potentially granting them administrator access and control over the connected Metabase instance. This could allow them to view, modify, or delete sensitive data and alter service behavior.
- Connected Metabase instance data.
- Via unauthenticated SQL injection.
- Unauthorized administrator access.
Operational Fix
Recommended remediation, mitigation, and detection steps
Responsibility for addressing this critical vulnerability likely falls to the Platform Engineering or Infrastructure teams who manage the Metabase deployment. The first practical step is to identify all instances of Metabase within the environment, determine their exposure (internal/external), and confirm which are business-critical. Subsequently, asset owners should be identified to prioritize and plan remediation, coordinating with the vendor for any necessary updates or patches.
- Platform or Infrastructure teams own resolution.
- Verify Metabase deployment reachability and criticality.
- Coordinate vendor updates and plan remediation.
