Unauthenticated Entity ID to Internal ID Translation Endpoints
Résumé
Summary
A set of internal ID translation routes shipped without the authentication middleware applied to the rest of the API.
Details
Metabase uses two identifier formats for most objects: an opaque public-looking identifier and an internal numeric ID. A small number of routes under the ...
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| metabase/metabase-core |
>= 1.58.0, < 1.58.13 |
1.58.13 |
|
| metabase/metabase-core |
>= 1.59.0, < 1.59.7 |
1.59.7 |
|
| metabase/metabase-core |
>= 1.60.0, < 1.60.1 |
1.60.1 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Summary
A set of internal ID translation routes shipped without the authentication middleware applied to the rest of the API.
Details
Metabase uses two identifier formats for most objects: an opaque public-looking identifier and an internal numeric ID. A small number of routes under the /api tree translate between the two and were intended only for authenticated frontend use.
Due to missing authentication enforcement, these routes were reachable without a session, allowing anonymous access to the translation lookup for any object whose opaque identifier the caller supplied.
The endpoints return identifier metadata only. The endpoints don’t expose row-level content. The practical impact is unauthenticated enumeration and reconnaissance against an exposed instance.
Patches
The fix is available in the following versions and above:
- 1.58.13, 0.58.13
- 1.59.7, 0.59.7
- 1.60.1, 0.60.1
Credit
Yasin Seyhun [Awaiting confirmation from reporter]
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY metabase/metabase