Rapid7 Vulnerability & Exploit Database

OpenMetadata authentication bypass and SpEL injection exploit chain

Back to Search

OpenMetadata authentication bypass and SpEL injection exploit chain

Disclosed
03/15/2024
Created
08/14/2024

Description

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. This module chains two vulnerabilities that exist in the OpenMetadata aplication. The first vulnerability, CVE-2024-28255, bypasses the API authentication using JWT tokens. It misuses the `JwtFilter` that checks the path of the url endpoint against a list of excluded endpoints that does not require authentication. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings that will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint. By chaining this vulnerability with CVE-2024-28254, that allows for arbitrary SpEL injection at endpoint `/api/v1/events/subscriptions/validation/condition/`, attackers are able to run arbitrary commands using Java classes such as `java.lang.Runtime` without any authentication. OpenMetadata versions `1.2.3` and below are vulnerable.

Author(s)

  • h00die-gr3y <h00die.gr3y@gmail.com>
  • Alvaro Muñoz alias pwntester (https://github.com/pwntester)

Platform

Linux,Unix

Architectures

cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/openmetadata_auth_bypass_rce
msf exploit(openmetadata_auth_bypass_rce) > show targets
    ...targets...
msf exploit(openmetadata_auth_bypass_rce) > set TARGET < target-id >
msf exploit(openmetadata_auth_bypass_rce) > show options
    ...show and set options...
msf exploit(openmetadata_auth_bypass_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;