La fiche CVE officielle n’est pas encore publiée
Publié d’après l’avis de l’éditeur. Remplacé par la fiche CVE.org / NVD dès sa publication.
RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
Résumé
Summary
Authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the POST /api/ee/serialization/import endpoint.
A crafted serialization archive injects an INIT property into the H2 JDBC spec, which can execute arbitrary S...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
認証済みの管理者が、細工したシリアライズアーカイブを取り込むことで、サーバー上でOSコマンドを実行したり、JVMが読める任意のファイルを読み取ったりできる脆弱性です。影響を受けるのはMetabase Enterpriseで、1.54.22、1.55.22、1.56.22、1.57.16、1.58.10、1.59.4以降の各版で修正されています。修正版へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| metabase | Metabase Enterprise |
All enterprise versions < 1.59.x |
>= 1.54.22 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Summary
Authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the POST /api/ee/serialization/import endpoint.
A crafted serialization archive injects an INIT property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud.
Impact
RCE: A two-step attack first writes a Clojure payload then executes it, achieving OS command execution.
Arbitrary File Read: Crafted YAML that can exfiltrate any file readable by the JVM process via an HTTP callback during sync.
Affected versions
Only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths.
All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected.
Patches
1.59.4
Docker image: metabase/metabase-enterprise:v1.59.4.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.59.4/metabase.jar
1.58.10
Docker image: metabase/metabase-enterprise:v1.58.10.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.58.10/metabase.jar
1.57.16
Docker image: metabase/metabase-enterprise:v1.57.16.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.57.16/metabase.jar
1.56.22
Docker image: metabase/metabase-enterprise:v1.56.22.x
Download the JAR here: https://downloads.metabase.com/enterprise/v1.56.22/metabase.jar
1.55.22
Docker image: metabase/metabase-enter…
Source: GitHub Repository Security Advisories (Game のスタック) NVD GitHub Advisory
Références
- GITHUB_REPO_ADVISORY metabase/metabase