CVE-2024-28254— OpenMetadata 安全漏洞
公开利用映射 1
Metasploit · 1 openmetadata_auth_bypass_rce.rb#CVE-2024-28254 [exploit]
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2024-28254 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
OpenMetadata 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
OpenMetadata是一个统一的发现、可观察和治理平台，由中央元数据存储库、深入的沿袭和无缝团队协作提供支持。 OpenMetadata 1.2.4之前版本存在安全漏洞，该漏洞源于GET /api/v1/events/subscriptions/validation/condition/中存在SpEL注入漏洞。攻击者可利用该漏洞执行远程代码。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| open-metadata | OpenMetadata | < 1.2.4 | - |
二、漏洞 CVE-2024-28254 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-28254 的情报信息
请登录查看更多情报信息。
CVE-2024-28254 厂商安全公告 (1)
CVE-2024-28254 其他参考 (4)
同批安全公告 · open-metadata · 2024-03-15 · 共 5 条
| CVE-2024-28255 | 9.8 CRITICAL | OpenMetadata 安全漏洞 |
| CVE-2024-28253 | 9.4 CRITICAL | OpenMetadata 安全漏洞 |
| CVE-2024-28847 | 8.8 HIGH | OpenMetadata 安全漏洞 |
| CVE-2024-28848 | 8.8 HIGH | OpenMetadata 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2024-28254
暂无评论