The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
Metabase Enterprise Edition、シリアライズ取り込みの不具合で遠隔からコードを実行される
Summary
認証済みの管理者が、細工したシリアライズアーカイブを取り込むことで、サーバー上でOSコマンドを実行したり、JVMが読める任意のファイルを読み取ったりできる脆弱性です。影響を受けるのはMetabase Enterpriseで、1.54.22、1.55.22、1.56.22、1.57.16、1.58.10、1.59.4以降の各版で修正されています。修正版へ更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
認証済みの管理者が、細工したシリアライズアーカイブを取り込むことで、サーバー上でOSコマンドを実行したり、JVMが読める任意のファイルを読み取ったりできる脆弱性です。影響を受けるのはMetabase Enterpriseで、1.54.22、1.55.22、1.56.22、1.57.16、1.58.10、1.59.4以降の各版で修正されています。修正版へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| metabase | Metabase Enterprise |
All enterprise versions < 1.59.x |
>= 1.54.22 |
Original description The description as published by the source.
Summary
Authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the POST /api/ee/serialization/import endpoint.
A crafted serialization archive injects an INIT property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud.
Impact
RCE: A two-step attack first writes a Clojure payload then executes it, achieving OS command execution.
Arbitrary File Read: Crafted YAML that can exfiltrate any file readable by the JVM process via an HTTP callback during sync.
Affected versions
Only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths.
All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected.
Patches
1.59.4
Docker image: metabase/metabase-enterprise:v1.59.4.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.59.4/metabase.jar
1.58.10
Docker image: metabase/metabase-enterprise:v1.58.10.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.58.10/metabase.jar
1.57.16
Docker image: metabase/metabase-enterprise:v1.57.16.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.57.16/metabase.jar
1.56.22
Docker image: metabase/metabase-enterprise:v1.56.22.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.56.22/metabase.jar
1.55.22
Docker image: metabase/metabase-enter…
Source: GitHub Repository Security Advisories (Game のスタック) NVD GitHub Advisory
References
- GITHUB_REPO_ADVISORY metabase/metabase