Metabase SQL injection via password reset endpoint
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
An attacker can inject malicious SQL code through Metabase's password reset feature without needing to log in, allowing them to take over the system as an administrator.
A SQL injection vulnerability exists in the '/reset_password' endpoint that accepts unsanitized input and executes it directly against the database. An unauthenticated attacker can exploit this to bypass authentication controls and escalate privileges to administrator level, resulting in complete system compromise.