cbcvebase.
CVE-2024-28847
published 2024-03-15

CVE-2024-28847: OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team…

PriorityP181high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.37%
81.7th percentile
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and, therefore, after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/events/subscriptions` which gets handled by `EventSubscriptionResource.createOrUpdateEventSubscription()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-251`.

Affected

1 ranges
VendorProductVersion rangeFixed in
open-metadataopenmetadata< 1.2.41.2.4

Detection & IOCsextracted from sources · hover to see the quote

url/api/v1/events/subscriptions
  • Detect PUT requests to the OpenMetadata API endpoint `/api/v1/events/subscriptions` — this is the attack vector for CVE-2024-28847 SpEL injection leading to RCE.
  • Authorization check occurs AFTER SpEL expression evaluation in `prepareInternal()`, meaning unauthenticated or low-privilege requests can trigger RCE before any auth gate is enforced — alert on any PUT to the subscriptions endpoint regardless of auth status.
  • Monitor OpenMetadata containers in Kubernetes for outbound connections to remote servers (especially China-geolocated IPs) following exploitation, indicative of cryptomining payload download.
  • Detect Netcat reverse shell activity originating from OpenMetadata containers post-exploitation.
  • Hunt for newly created cronjobs within OpenMetadata Kubernetes pods — attackers use cronjobs to maintain persistence and schedule malicious code execution.
  • Use the following kubectl command to enumerate all OpenMetadata workloads in a Kubernetes cluster for patch status assessment: `kubectl get pods --all-namespaces -o=jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep 'openmetadata'`
  • ·Vulnerability is patched in OpenMetadata version 1.2.4 and newer — any instance running a version prior to 1.2.4 is vulnerable to this unauthenticated SpEL RCE.
  • ·There are no known workarounds; patching to 1.2.4+ is the only remediation. Internet-exposed OpenMetadata workloads with default credentials are at heightened risk.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.