CVE-2025-50465
📋 TL;DR
OpenMetadata versions up to 1.4.4 contain a SQL injection vulnerability in the TestDefinitionDAO interface. Attackers can exploit the testPlatform parameter in the listCount function to execute arbitrary SQL queries and extract sensitive data from the database. This affects all deployments running vulnerable OpenMetadata versions.
💻 Affected Systems
- OpenMetadata
📦 What is this software?
Openmetadata by Open Metadata
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, data manipulation, or potential privilege escalation to underlying systems.
Likely Case
Unauthorized data extraction from OpenMetadata database including sensitive metadata, user information, or configuration data.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Proof of concept available in public gist. Exploitation requires access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 1.4.4
Vendor Advisory: https://github.com/open-metadata/OpenMetadata/security/advisories
Restart Required: Yes
Instructions:
1. Upgrade OpenMetadata to version 1.4.5 or later. 2. Restart the OpenMetadata service. 3. Verify the fix by checking the version and testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or proxy rules to filter SQL injection patterns in testPlatform parameter
Database Permission Restriction
allLimit database user permissions to read-only for the application account
🧯 If You Can't Patch
- Implement strict input validation for the testPlatform parameter at the application layer
- Restrict network access to OpenMetadata endpoints to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check OpenMetadata version. If version <= 1.4.4, examine the CollectionDAO.java file lines 3515-3517 for vulnerable SQL construction.Check Version:
Check OpenMetadata UI or configuration files for version informationVerify Fix Applied:
Verify OpenMetadata version > 1.4.4 and check that parameterized queries are used in TestDefinitionDAO interface.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL errors
- Requests with SQL syntax in testPlatform parameter
Network Indicators:
- Unusual database connection patterns from application server
- Large data transfers from database
SIEM Query:
source="openmetadata" AND (testPlatform CONTAINS "UNION" OR testPlatform CONTAINS "SELECT" OR testPlatform CONTAINS "--")🔗 References
- https://gist.github.com/javadk/c23cc3276f3fb5587b0f4345d7a71a7f
- https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3515
- https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3517
