Unauthenticated Entity ID to Internal ID Translation Endpoints
概要
Summary
A set of internal ID translation routes shipped without the authentication middleware applied to the rest of the API.
Details
Metabase uses two identifier formats for most objects: an opaque public-looking identifier and an internal numeric ID. A small number of routes under the ...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| metabase/metabase-core |
>= 1.58.0, < 1.58.13 |
1.58.13 |
|
| metabase/metabase-core |
>= 1.59.0, < 1.59.7 |
1.59.7 |
|
| metabase/metabase-core |
>= 1.60.0, < 1.60.1 |
1.60.1 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Summary
A set of internal ID translation routes shipped without the authentication middleware applied to the rest of the API.
Details
Metabase uses two identifier formats for most objects: an opaque public-looking identifier and an internal numeric ID. A small number of routes under the /api tree translate between the two and were intended only for authenticated frontend use.
Due to missing authentication enforcement, these routes were reachable without a session, allowing anonymous access to the translation lookup for any object whose opaque identifier the caller supplied.
The endpoints return identifier metadata only. The endpoints don’t expose row-level content. The practical impact is unauthenticated enumeration and reconnaissance against an exposed instance.
Patches
The fix is available in the following versions and above:
- 1.58.13, 0.58.13
- 1.59.7, 0.59.7
- 1.60.1, 0.60.1
Credit
Yasin Seyhun [Awaiting confirmation from reporter]
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY metabase/metabase