PT-2022-24927 · Metabase · Metabase

Ronan Donohue · Published 2022-10-26 · Updated 2022-10-28 · CVE-2022-39359

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9

Description The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirects to otherwise disallowed addresses, such as link-local or private-network addresses. This has been patched, and Metabase no longer follows redirects on GeoJSON map URLs. An environment variable MB CUSTOM GEOJSON ENABLED was added to disable custom GeoJSON completely, with true as the default setting.

Recommendations For versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, update to version 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9 to resolve the issue. As a temporary workaround, consider setting the environment variable MB CUSTOM GEOJSON ENABLED to false to disable custom GeoJSON completely until a patch is applied.

Exploit

Fix

Open Redirect

Information Disclosure

Weakness Enumeration

CWE-601

CWE-200

Related Identifiers

CVE-2022-39359

GHSA-W5J7-4MGM-77F4

Affected Products

Metabase

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39359.json · Exploit
• https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39359 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39359 · Vendor Advisory
• https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4 · Note