PT-2024-3068 · Unknown · Openmetadata

Pwntester · Published 2024-03-07 · Updated 2024-04-19 · CVE-2024-28254

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.2.4

Description The issue is related to the AlertUtil::validateExpression method, which evaluates an SpEL expression using getValue with the StandardEvaluationContext, allowing interaction with Java classes such as java.lang.Runtime and leading to Remote Code Execution. The /api/v1/events/subscriptions/validation/condition/<expression> endpoint passes user-controlled data to AlertUtil::validateExpression, enabling authenticated non-admin users to execute arbitrary system commands on the underlying operating system due to a missing authorization check. This may lead to Remote Code Execution.

Recommendations For versions prior to 1.2.4, upgrade to version 1.2.4 or later to address the issue. As a temporary workaround, consider restricting access to the /api/v1/events/subscriptions/validation/condition/<expression> endpoint and disabling the AlertUtil::validateExpression method until a patch is available. Additionally, restrict the use of the java.lang.Runtime class to minimize the risk of exploitation.

Exploit

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

BDU:2024-03261

CVE-2024-28254

GHSA-J86M-RRPR-G8GW

Affected Products

Openmetadata

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/openmetadata_auth_bypass_rce.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28254.json · Exploit
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-j86m-rrpr-g8gw · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03261 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-26.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28254 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28254 · Vendor Advisory
• https://github.com/spring-projects/spring-framework/blob/4e2d3573189b7c0afce62bce29cd915de4077f56/spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpression.java#L106 · Note
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L108 · Note
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L101 · Note
• https://t.me/aptreports/9298 · Telegram Post
• https://t.me/aptreports/9296 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024042222 · Note
• https://twitter.com/win3zz/status/1779388643523842127 · Twitter Post
• https://vuldb.com/ru/?id.256995 · Note