CVE-2024-28848
published 2024-03-15CVE-2024-28848: OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team…
PriorityP183high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
7.89%
94.0th percentile
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/` endpoint passes user-controlled data `CompiledRule::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-236`. This issue may lead to Remote Code Execution and has been resolved in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open-metadata | openmetadata | < 1.2.4 | 1.2.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for SpEL (Spring Expression Language) injection attempts targeting the /api/v1/policies/validation/condition/ endpoint; payloads referencing java.lang.Runtime are indicative of exploitation. ↗
- →Any authenticated non-admin user triggering the /api/v1/policies/validation/condition/ endpoint should be treated as suspicious, as no authorization check (Authorizer.authorize()) is performed on this path. ↗
- →Hunt for outbound connections from OpenMetadata containers to remote servers in China, which were used to host cryptomining malware payloads delivered post-exploitation. ↗
- →Detect Netcat reverse shell activity originating from OpenMetadata containers, used by attackers to establish persistent remote access post-exploitation. ↗
- →Look for newly created cronjobs within OpenMetadata Kubernetes pods, which attackers use to maintain persistence by scheduling malicious code execution. ↗
- →Alert on Monero (XMR) cryptomining processes or related miner binaries spawned from OpenMetadata container processes, consistent with observed attacker objectives. ↗
- ·Exploitation requires only authentication as a non-admin user; no elevated privileges are needed. Ensure default credentials are changed on all Internet-exposed OpenMetadata deployments. ↗
- ·The vulnerability is fully remediated only in OpenMetadata version 1.2.4 and newer; no workarounds exist for older versions. ↗
- ·Active exploitation of this CVE (alongside CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28254) has been observed in the wild since early April targeting Internet-exposed Kubernetes OpenMetadata workloads. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
osv·2024-04-24
CVE-2024-28848 [HIGH] OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/` (`GHSL-2023-236`)
### SpEL Injection in `GET /api/v1/policies/validation/condition/` (`GHSL-2023-236`)
***Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability. A user must exist in OpenMetadata and have authenticated themselves to exploit this vulnerability.***
The [`CompiledRule::validateExpression`](https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51) method evaluates an SpEL expression using an [`StandardEvaluationContext`](https://github.com/open-metadata/
GHSA
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
ghsa·2024-04-24
CVE-2024-28848 [HIGH] CWE-94 OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/` (`GHSL-2023-236`)
### SpEL Injection in `GET /api/v1/policies/validation/condition/` (`GHSL-2023-236`)
***Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability. A user must exist in OpenMetadata and have authenticated themselves to exploit this vulnerability.***
The [`CompiledRule::validateExpression`](https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51) method evaluates an SpEL expression using an [`StandardEvaluationContext`](https://github.com/open-metadata/
VulnCheck
OpenMetadata SpEL Injection in GET /api/v1/policies/validation/condition/<expr>
vulncheck·2024·CVSS 8.8
CVE-2024-28848 [HIGH] OpenMetadata SpEL Injection in GET /api/v1/policies/validation/condition/<expr>
OpenMetadata SpEL Injection in GET /api/v1/policies/validation/condition/
The OpenMetadata CompiledRule::validateExpression method evaluates an SpEL expression using an StandardEvaluationContext which allows the expression to reach and interact with Java classes such as java.lang.Runtime and leading to Remote Code Execution. The /api/v1/policies/validation/condition/ endpoint passes user-controlled data CompiledRule::validateExpession allowing authenticated (non-admin) users to execute arbitrary system commands on the underlying operating system. There is also a missing authorization check since Authorizer.authorize() is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbit
No detection rules found.
No public exploits indexed.
Wiz
Crying Out Cloud - May 2024 Newsletter | Wiz
blogs_wiz·2024-05-06·CVSS 10.0
[CRITICAL] Crying Out Cloud - May 2024 Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
Here are our top picks of cloud security highlights!
## 🔎 Highlights
Architecture Risks that May Compromise AI-as-a-Service Providers
Wiz research recently performed a security audit of Hugging Face and discovered several security issues that would have allowed an actor running a specially-crafted malicious model on Hugging Face's infrastructure to achieve remote code execution and cross-tenant access to other customers' spaces or models. All these issues were remediated by Hugging Face and no customer action is required.
Learn more in our blog .
## 🐞 High Profile Vulnerabilities
DoS Vulnerability in HTTP/2 CONTINUATION Frames
Bleepingcomputer
Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks
blogs_bleepingcomputer·2024-04-17·CVSS 9.4
[CRITICAL] Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks
## Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks
## Sergiu Gatlan
In an ongoing Kubernetes cryptomining campaign, attackers target OpenMetadata workloads using critical remote code execution and authentication vulnerabilities.
OpenMetadata is an open-source metadata management platform that helps data engineers and scientists to catalog and discover data assets within their organization, including databases, tables, files, and services.
The security vulnerabilities exploited in these attacks ( CVE-2024-28255 , CVE-2024-28847 , CVE-2024-28253 , CVE-2024-28848 , and CVE-2024-28254 ) were reported on December 14 by GitHub Security Lab's Alvaro Muñoz and patched on January 5 in OpenMetadata versions 1.2.4 and newer.
According to Collate CTO and OpenMetadata project m
https://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionhttps://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L57https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5xv3-fm7g-865rhttps://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionhttps://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L57https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5xv3-fm7g-865r
2024-03-15
Published
Exploited in the wild