PT-2024-2893 · Unknown · Openmetadata

Pwntester · Published 2024-03-15 · Updated 2024-04-19 · CVE-2024-28255

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.2.4

Description The issue is related to the authentication mechanism in OpenMetadata, specifically with the JwtFilter that handles API authentication by verifying JWT tokens. An attacker can bypass the authentication mechanism by manipulating path parameters to make any path contain arbitrary strings, allowing access to arbitrary endpoints without JWT validation. This can lead to authentication bypass and potentially to arbitrary SpEL expression injection. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 1.2.4, upgrade to version 1.2.4 or later to address the authentication bypass issue. As a temporary workaround, consider restricting access to sensitive endpoints that may be vulnerable to SpEL expression injection until the upgrade is applied. Avoid using the GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111 endpoint or similar manipulated paths that can bypass JWT validation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-03058

CVE-2024-28255

GHSA-6WX7-QW5P-WH84

Affected Products

Openmetadata

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/openmetadata_auth_bypass_rce.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28255.json · Exploit
• 🔥 https://github.com/YongYe-Security/CVE-2024-28255 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/authentication-bypass-with-path-parameter-in-openmetadata-cve-2024-28255 · Exploit
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03058 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-26.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2024-28255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28255 · Security Note
• https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L111 · Note
• https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L113 · Note
• https://t.me/aptreports/9298 · Telegram Post
• https://t.me/aptreports/9296 · Telegram Post
• https://twitter.com/socradar/status/1780995447034728751 · Twitter Post
• https://twitter.com/win3zz/status/1779388643523842127 · Twitter Post