CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Medium 6.5 Published 26 Oct 2022 Updated 23 Apr 2025

Attackers can exploit GeoJSON URL redirects to access private network resources, bypassing security restrictions in Metabase.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-39359?

CVE-2022-39359 is a medium-severity server-side request forgery vulnerability in metabase, published on 26 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default).

Weakness: CWE-601, CWE-200

Which versions are affected by CVE-2022-39359?

It affects 1 product.

Products include Metabase Metabase.

How do I fix CVE-2022-39359?

No fix has been published for CVE-2022-39359 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-39359 being exploited?

There is no known exploitation of CVE-2022-39359 in the wild and no public exploit code.

Sources

Also known as GHSA-w5j7-4mgm-77f4.