CVE-2022-24853 File system exposure in Metabase

Medium 5.9 Published 14 Apr 2022 Updated 22 Apr 2025

Attackers can exploit a proxy flaw to access local files and perform NTLM relay attacks, potentially stealing system password hashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24853?

CVE-2022-24853 is a medium-severity server-side request forgery vulnerability in metabase, published on 14 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Weakness: CWE-200

Which versions are affected by CVE-2022-24853?

It affects 1 product.

Products include Metabase Metabase.

How do I fix CVE-2022-24853?

No fix has been published for CVE-2022-24853 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-24853 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24853 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-5cfq-582c-c38m.