Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to DB Theft
Metabase confirms active exploitation exploiting an unauthenticated SQL injection vulnerability via password reset APIs to hijack admin controls.
Stock photo for illustration only, not from the actual event
- Metabase has confirmed active exploitation involving SQL injection vulnerabilities.
- Metabase Cloud is already patched, but self-hosted environments require manual updates.
- Threat actors inject SQL without authentication into public password reset APIs to steal admin rights.
Data analytics platform Metabase has officially confirmed active exploitation in the wild, following reports from Framework and Tally regarding unauthorized access and data leakage starting August 3. While users on Metabase Cloud are already protected with patches, organizations running self-hosted environments must manually apply updates as soon as possible.
This ongoing attack allows threat actors to inject SQL statements without any authentication directly into the public password reset API. By doing so, they elevate their access to Metabase administrator privileges, allowing them to harvest and export connected database credentials alongside any viewable data within the platform.
Stock photo for illustration only, not from the actual event
For standard users, the service appears completely normal, displaying standard analytical interfaces with no required actions during a breach. For administrators, however, the attack manifests as an HTTP 400 POST request sent to the password reset API that seems to fail, immediately followed by a successful HTTP 200 response on /api/user/current. Additional indicators of compromise include unknown administrators or API keys, unusual database queries, and abnormal utilization of connected data sources.
This vulnerability is exceptionally critical because it bypasses standard authentication checks to grant full administrative control. Gaining access to database credentials inside Metabase doesn't just expose analytics data; it opens the door for direct backend database compromises if those credentials can be abused externally. Organizations must rigorously audit network exposure and permissions.
As a result of the compromise, Metabase administrator privileges, system settings, API keys, and connected database credentials are fully compromised. Attackers can query and export sensitive customer and business records visible inside Metabase. Furthermore, direct abuse of these database connection credentials allows unauthorized access to backend databases from outside the Metabase ecosystem entirely.
Metabase notes that if system logs contain the specific combination of a POST 400 request followed by a GET 200 request, a system compromise is extremely likely.
Stock photo for illustration only, not from the actual event
Because Metabase is frequently deployed independently by individual departments or run within small-scale Docker environments, public instances often remain hidden from central IT oversight. Security operations teams must push beyond basic vulnerability management by deploying asset discovery tools to verify whether any Metabase instances or target endpoints are publicly exposed. If indicators of compromise surface, the investigation scope must expand immediately to cover all connected databases, alongside preparing a parallel response for potential personal data breaches if consolidated customer or employee records are impacted.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment