CVE-2022-24853

MEDIUM

Metabase 0.40.0-0.40.8 - Exposure of Sensitive Information via NTLM Relay Attack

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-24853. PoCs published by secure-77.

AI-analyzed exploit summary This PoC demonstrates an NTLM reflection/relay attack in Metabase via a crafted URL that triggers an SSRF vulnerability. The attack leverages the `jar:file:` protocol to force authentication requests to an attacker-controlled server.

Description

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Exploits (1)

nomisec WORKING POC 2 stars
by secure-77 · poc
https://github.com/secure-77/CVE-2022-24853

This PoC demonstrates an NTLM reflection/relay attack in Metabase via a crafted URL that triggers an SSRF vulnerability. The attack leverages the `jar:file:` protocol to force authentication requests to an attacker-controlled server.

Classification
Working Poc 90%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: Metabase (versions affected by CVE-2022-24853)
No auth needed
Prerequisites: Attacker-controlled server to capture NTLM hashes · Network access to the Metabase instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38m
Exploit, Third Party Advisory x_refsource_misc
https://secure77.de/metabase-ntlm-relay-attack/

Scores

CVSS v3 5.9
EPSS 0.0244
EPSS Percentile 82.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
metabase/metabase 0.40.0 - 0.40.8
Published Apr 14, 2022
Tracked Since Feb 18, 2026