PT-2024-3067 · Unknown · Openmetadata

Pwntester

·

Published

2024-03-11

·

Updated

2025-09-04

·

CVE-2024-28847

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.2.4
Description The issue is related to the AlertUtil::validateExpression method, which can lead to Remote Code Execution. An attacker can send a PUT request to "/api/v1/events/subscriptions" to exploit this vulnerability. The prepare() method is called from EntityRepository.prepareInternal(), which in turn gets called from EntityResource.createOrUpdate(). Although there is an authorization check, it gets called after the SpEL expression has been evaluated. This vulnerability may lead to Remote Code Execution and has been addressed in version 1.2.4.
Recommendations To resolve the issue, upgrade to version 1.2.4 or later. As a temporary workaround, consider disabling the AlertUtil::validateExpression function until a patch is available. Restrict access to the /api/v1/events/subscriptions API endpoint to minimize the risk of exploitation. Avoid using the condition parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-03260
CVE-2024-28847
GHSA-8P5R-6MVV-2435

Affected Products

Openmetadata