CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
Authenticated non-admin users can execute arbitrary system commands via SpEL injection in the policy validation endpoint due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28848?
CVE-2024-28848 is a high-severity code injection vulnerability in open-metadata OpenMetadata, published on 15 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/<expression>` endpoint passes user-controlled data `CompiledRule::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-236`. This issue may lead to Remote Code Execution and has been resolved in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2024-28848?
2 open source packages ship an affected version, including org.open-metadata:openmetadata-service. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.open-metadata:openmetadata-service Maven | All versions | 1.2.4 |
org.open-metadata:openmetadata-service Maven | All versions | 1.2.4 |
Products include Open-Metadata Openmetadata.
How do I fix CVE-2024-28848?
Upgrade org.open-metadata:openmetadata-service to 1.2.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-28848 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28848 exists.
Other vulnerabilities in open-metadata OpenMetadata
- CVE-2024-28255 Authentication Bypass in OpenMetadata
- CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
- CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
- CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata
- CVE-2026-22244 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
Sources
Also known as GHSA-5xv3-fm7g-865r.