CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata

High 8.8 Published 15 Mar 2024 Updated 13 Aug 2024

Authenticated non-admin users can execute arbitrary system commands via SpEL injection in the event subscription validation endpoint due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-28254?

CVE-2024-28254 is a high-severity code injection vulnerability in open-metadata OpenMetadata, published on 15 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2024-28254?

It affects 1 product.

Products include Open-Metadata Openmetadata.

How do I fix CVE-2024-28254?

No fix has been published for CVE-2024-28254 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-28254 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28254 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-j86m-rrpr-g8gw.