This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OpenMetadata < 1.2.4 has a **SpEL Injection** flaw in `GET /api/v1/policies/validation/condition/`. ๐ **Consequences**: Attackers can execute **Remote Code Execution (RCE)** on the server.โฆ
๐ก๏ธ **Root Cause**: **CWE-94** (Code Injection). The vulnerability stems from unsafe handling of Spring Expression Language (SpEL) in `CompiledRule.java`. โ ๏ธ User input is likely evaluated directly without sanitization.
๐ป **Attacker Actions**: Full **Remote Code Execution**. ๐ต๏ธโโ๏ธ Can access sensitive data, modify system state, and compromise the entire infrastructure. CVSS Score indicates **High** impact across all metrics.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **Low**. ๐ Network Accessible (AV:N). โ๏ธ Requires **Low Privileges** (PR:L) but **No User Interaction** (UI:N). ๐ซ Authentication is likely required, but the bar is low.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐งช **Public Exploit**: **No**. ๐ญ The `pocs` array is empty in the data. ๐ซ No known wild exploitation or public PoC provided in this dataset.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for OpenMetadata instances. ๐ต๏ธโโ๏ธ Check if version is **< 1.2.4**. ๐ก Monitor API calls to `/api/v1/policies/validation/condition/` for SpEL payloads (e.g., `T(java.lang.Runtime)...`).
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: **Yes**. ๐ ๏ธ Upgrade to **OpenMetadata 1.2.4** or later. ๐ Official advisory: GHSA-5xv3-fm7g-865r. ๐ See GitHub source links for details.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Implement **WAF rules** to block SpEL syntax in API parameters. ๐ Restrict access to the `/policies/validation/condition/` endpoint. ๐งฑ Input validation at the application layer.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **CRITICAL**. ๐จ CVSS Vector: `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. ๐โโ๏ธ Immediate patching recommended due to RCE risk and low exploitation barrier.