CVE-2025-50467
📋 TL;DR
OpenMetadata versions up to 1.4.4 contain a SQL injection vulnerability in the TestDefinitionDAO interface. Attackers can exploit the supportedDataTypeParam parameter in the listCount function to extract sensitive database information. This affects all deployments running vulnerable versions of OpenMetadata.
💻 Affected Systems
- OpenMetadata
📦 What is this software?
Openmetadata by Open Metadata
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including extraction of sensitive metadata, user credentials, and configuration data, potentially leading to complete system takeover.
Likely Case
Unauthorized data extraction from the OpenMetadata database, exposing metadata about data assets, user information, and system configurations.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only exposing non-sensitive metadata.
🎯 Exploit Status
Exploitation requires understanding of the API endpoint and parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >1.4.4
Vendor Advisory: https://github.com/open-metadata/OpenMetadata/security/advisories
Restart Required: No
Instructions:
1. Upgrade OpenMetadata to version 1.4.5 or later. 2. Verify the fix by checking the CollectionDAO.java file for proper parameterized queries in the listCount function.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or proxy rules to filter suspicious SQL patterns in the supportedDataTypeParam parameter.
🧯 If You Can't Patch
- Implement strict database user permissions to limit what data can be accessed via the vulnerable function.
- Deploy network segmentation to restrict access to the OpenMetadata API endpoints.
🔍 How to Verify
Check if Vulnerable:
Check OpenMetadata version via admin interface or by examining deployment configuration. If version <=1.4.4, system is vulnerable.Check Version:
Check OpenMetadata UI admin panel or deployment configuration files for version information.Verify Fix Applied:
After upgrade, verify that the CollectionDAO.java file no longer contains raw SQL concatenation with the supportedDataTypeParam parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in application logs
- Multiple rapid requests to TestDefinitionDAO endpoints with varying parameters
Network Indicators:
- Unusual patterns in API calls to /api/v1/testDefinition endpoints with SQL-like parameters
SIEM Query:
source="openmetadata" AND (uri_path="/api/v1/testDefinition" AND (param="supportedDataTypeParam" AND value CONTAINS "' OR "))🔗 References
- https://gist.github.com/javadk/ed0d38e4578405672f154e289036a705
- https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3527
- https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3528
