Zero-Day in Metabase: SQL Injection with CVSS 10.0 Used to Steal Customer Data

Metabase, the company behind the popular business intelligence platform, has reported attacks exploiting a previously unknown vulnerability (a “0-day”). It is an unauthenticated SQL injection affecting versions 1.58 and later. The flaw has been given the maximum severity rating — CVSS 10.0 — though it has not yet received a dedicated CVE identifier.

According to Metabase CEO Sameer Al-Sakran, the attacker was able to inject arbitrary SQL code into the application's database and ultimately obtain administrator privileges over the instance. This opened the door to altering the configuration, stealing stored credentials for connected databases, and reading and exfiltrating any information accessible through them. Active exploitation has been confirmed.

What to Do

Metabase Cloud, according to the company, has already been patched, and the endpoints used in the attack have been blocked. Those who deploy Metabase on their own will have to update manually. Fixes have been released for branches 0.58 through 0.63; the minimum safe releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5.

If updating immediately is not possible, it is recommended to temporarily block access to the /api/session/reset_password endpoint. Beyond updating, Metabase advises revoking all active user sessions, reviewing API keys and administrator accounts, rotating the credentials of connected databases, and examining logs. A sign of compromise is a POST request to /api/session/reset_password returning a 400, followed by a successful GET to /api/user/current. That said, the company warns that the corresponding log entries have most likely already been wiped by the attackers.

Who Was Affected

Laptop maker Framework has confirmed the theft of customer data: names, email addresses, login IP addresses, billing and mailing addresses, phone numbers, and company names. For business customers, the leak may also have included VAT, EIN, and billing email. Metabase notified Framework on August 6 that its instance had been accessible to the attacker as early as August 3.

Tally, an online form-building service, reported the compromise of its analytics environment on the same day, August 3. According to the company, email addresses and passwords in the form of cryptographic hashes were leaked, though the forms themselves and user responses are stored separately and were not affected. When asked by BleepingComputer about the hashing algorithm and the use of salt, the company had not responded by the time of publication.

LexisNexis also spoke about the consequences of the attack: the company reported “unusual activity” on the servers of a third-party provider and disconnected from them, which temporarily made the Diligence, Metabase API, and Newsdesk services unavailable. The letter does not draw a direct link to the Metabase vulnerability, and the question of a data breach remains open for now — an investigation is underway with the involvement of an outside expert firm.

Source: Bleeping Computer