CVE-2024-28253

CRITICALNuclei

SpEL Injection in `PUT /api/v1/policies` in OpenMetadata

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-28253 has a selected CVSS score of 9.4 (critical); EIP currently links 1 Nuclei template.

Description

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 17, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 18, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

OpenMetadata

Browse Netlify / OpenMetadata
VulnCheckVersion data not supplied

OpenMetadata

Browse open-metadata / OpenMetadata

Default status: unknown

CVE List< 1.3.1affected
Before 1.3.1affected

org.open-metadata:openmetadata-service

Browse Maven / org.open-metadata:openmetadata-service
GitHub AdvisoryBefore 1.3.1 · Fixed in 1.3.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALOpenMetaData - SpEL Injection in PUT /api/v1/policiesCVSS 9.4

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact

Attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Remediation

Upgrade to version 1.3.1 or later.

WeaknessesCWE-94
Authorsdaffainfo
Template tagscvecve2024openmetadataspelrceintrusivefile-uploadoastvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CPE: cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:"733091897"
FOFA: icon_hash="733091897"
Google: intitle:"openmetadata"
https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/ https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6gr https://nvd.nist.gov/vuln/detail/VE-2024-28253 https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693

Source: ProjectDiscovery

References

9