This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OpenMetadata < 1.3.1 suffers from **SpEL Injection** via `PUT /api/v1/policies`.โฆ
๐ฆ **Affected**: **OpenMetadata** versions **prior to 1.3.1**. Specifically, the `PolicyRepository` and `EntityRepository` components handling policy creation/update via the API. ๐
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: Full **Remote Code Execution**. An unauthenticated attacker can send a crafted `PUT` request to execute arbitrary system commands, compromising the entire server. ๐ดโโ ๏ธ
Q5Is exploitation threshold high? (Auth/Config)
โก **Exploitation Threshold**: **LOW**. CVSS Vector: `AV:N/AC:L/PR:N/UI:N`. No authentication (`PR:N`) or user interaction (`UI:N`) required. Network-accessible and easy to exploit. ๐ฏ
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exploit**: **YES**. A Nuclei template is available on GitHub (`projectdiscovery/nuclei-templates`). Proof of Concept confirms RCE capability. Wild exploitation is highly likely. ๐
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for OpenMetadata instances exposing `/api/v1/policies`. Use Nuclei with the CVE-2024-28253 template. Check if the version is < 1.3.1. Look for SpEL injection patterns in policy inputs. ๐ต๏ธโโ๏ธ
Q8Is it fixed officially? (Patch/Mitigation)
โ **Official Fix**: **YES**. Fixed in **OpenMetadata 1.3.1**. The vendor advises immediate upgrade. No known workarounds exist, so patching is the only reliable defense. ๐ ๏ธ
Q9What if no patch? (Workaround)
๐ง **No Patch Workaround**: **NONE**. The advisory explicitly states: "There are no known workarounds." You must upgrade or isolate the service from the network immediately. ๐ซ
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **CRITICAL**. High CVSS score (8.6), unauthenticated RCE, and public PoC exist. Prioritize patching to **1.3.1+** immediately to prevent server compromise. ๐จ