GeoJSON URL validation can expose server files and environment variables to unauthorized users
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 10epss 97%
da publicação à arma4 dias
Publicada no NVD17 de nov.
1ª PoC+4d
CISA KEV+1091d
probabilidade de exploração
97%top 1% das CVEs
exploração observada
simCISA + VulnCheck
12 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2024-12-03
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Produtos afetados
metabase · metabasePoCs públicas encontradas — 12
githubgithub.com/tahtaciburak/CVE-2021-41277★ 11githubgithub.com/zer0yu/CVE-2021-41277★ 9githubgithub.com/z3n70/CVE-2021-41277★ 5githubgithub.com/Vulnmachines/Metabase_CVE-2021-41277★ 4githubgithub.com/RubXkuB/PoC-Metabase-CVE-2021-41277★ 1githubgithub.com/TheLastVvV/CVE-2021-41277★ 0githubgithub.com/Henry4E36/Metabase-cve-2021-41277★ 0githubgithub.com/kap1ush0n/CVE-2021-41277★ 0githubgithub.com/kaizensecurity/CVE-2021-41277★ 0vulncheckvulncheck.com/xdb/ade2199af4d8não verificadovulncheckvulncheck.com/xdb/d82529f295a2não verificadovulncheckvulncheck.com/xdb/4a3d504338fenão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.