CVE-2024-28253
📋 TL;DR
This vulnerability in OpenMetadata allows remote attackers to execute arbitrary code by exploiting a Spring Expression Language (SpEL) injection flaw. Attackers can send crafted PUT requests to the policies API endpoint, bypassing authorization checks that occur after the vulnerable code executes. All OpenMetadata instances running vulnerable versions are affected.
💻 Affected Systems
- OpenMetadata
📦 What is this software?
Openmetadata by Open Metadata
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with complete control over the OpenMetadata server, allowing data theft, service disruption, and lateral movement to connected systems.
Likely Case
Remote code execution leading to metadata manipulation, data exfiltration, and potential privilege escalation within the OpenMetadata environment.
If Mitigated
Limited impact if network segmentation restricts access, but successful exploitation still compromises the OpenMetadata instance.
🎯 Exploit Status
Exploitation requires sending a crafted PUT request to /api/v1/policies. While authentication may be required, the authorization check occurs after the vulnerable code executes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1
Vendor Advisory: https://github.com/open-metadata/OpenMetadata/security/advisories
Restart Required: Yes
Instructions:
1. Backup your OpenMetadata configuration and data. 2. Stop the OpenMetadata service. 3. Update to version 1.3.1 or later using your deployment method (Docker, Kubernetes, or direct installation). 4. Restart the service. 5. Verify the update was successful.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict network access to OpenMetadata instances using firewalls or network segmentation
- Implement web application firewall (WAF) rules to block suspicious PUT requests to /api/v1/policies
🔍 How to Verify
Check if Vulnerable:
Check if your OpenMetadata version is below 1.3.1 by accessing the UI or API and reviewing the version information.Check Version:
curl -X GET http://your-openmetadata-server:8585/api/v1/system/versionVerify Fix Applied:
Confirm the OpenMetadata version is 1.3.1 or higher and test that PUT requests to /api/v1/policies with SpEL payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual PUT requests to /api/v1/policies endpoint
- SpEL expression patterns in request logs
- Unexpected process execution from OpenMetadata service
Network Indicators:
- PUT requests to /api/v1/policies containing SpEL syntax like T(java.lang.Runtime)
- Outbound connections from OpenMetadata server to unexpected destinations
SIEM Query:
source="openmetadata" AND (uri_path="/api/v1/policies" AND http_method="PUT" AND (request_body="*T(*" OR request_body="*Runtime*" OR request_body="*getRuntime*"))🔗 References
- https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365
- https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113
- https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6gr
- https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365
- https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113
- https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6gr
