CVE-2022-24854
📋 TL;DR
This vulnerability in Metabase allows attackers with SQL permissions on one SQLite database to attach and query across multiple SQLite databases if they know the file paths. Only Metabase users utilizing SQLite databases are affected by this cross-database query capability.
💻 Affected Systems
- Metabase
📦 What is this software?
Metabase by Metabase
Metabase by Metabase
Metabase by Metabase
Metabase by Metabase
⚠️ Risk & Real-World Impact
Worst Case
Complete data exfiltration across all attached SQLite databases, potentially exposing sensitive business intelligence data, customer information, or proprietary analytics.
Likely Case
Unauthorized data access and potential data leakage between SQLite databases used within the same Metabase instance.
If Mitigated
Limited to authorized database access only, with no cross-database query capability.
🎯 Exploit Status
Exploitation requires SQL permissions on at least one database and knowledge of target database file paths. The ATTACH DATABASE SQL command is well-documented and straightforward to use.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.43.7.2 and v1.43.7.2
Vendor Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329
Restart Required: Yes
Instructions:
1. Backup your Metabase instance and databases. 2. Download and install Metabase v0.43.7.2 or v1.43.7.2 from the official repository. 3. Restart the Metabase service. 4. Verify the version is updated and functionality is working correctly.
🔧 Temporary Workarounds
SQLite Connection String Modification
allAdd limit_attached=0 parameter to SQLite connection strings to disable ATTACH DATABASE functionality
Modify SQLite connection strings to include: ?limit_attached=0
🧯 If You Can't Patch
- Implement strict access controls to limit SQL permissions and database file path knowledge
- Migrate from SQLite to PostgreSQL, MySQL, or other database backends not affected by this vulnerability
🔍 How to Verify
Check if Vulnerable:
Check Metabase version: if using SQLite and version is below v0.43.7.2 or v1.43.7.2, the system is vulnerable.Check Version:
Check Metabase admin settings or run: java -jar metabase.jar versionVerify Fix Applied:
Verify Metabase version is v0.43.7.2 or v1.43.7.2 or higher, and test that ATTACH DATABASE SQL commands are properly restricted.📡 Detection & Monitoring
Log Indicators:
- SQL queries containing ATTACH DATABASE commands
- Unusual cross-database query patterns
Network Indicators:
- Increased database query traffic from single users
- Unusual data access patterns across database boundaries
SIEM Query:
source="metabase" AND ("ATTACH DATABASE" OR "DETACH DATABASE")