CVE-2022-24854
Database bypassing any permissions in Metabase via SQlite attach
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you're unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected.
Metabase es una aplicación de análisis e inteligencia empresarial de código abierto. SQLite presenta una característica similar a FDW llamada "ATTACH DATABASE", que permite conectar múltiples bases de datos SQLite por medio de la conexión inicial. Si el atacante presenta permisos de SQL en al menos una base de datos SQLite, entonces puede adjuntar esta base de datos a una segunda base de datos, y entonces puede consultar todas las tablas. Para poder hacer esto, el atacante también necesita conocer la ruta del archivo de la segunda base de datos. Es recomendado a usuarios actualizar lo antes posible. Si no puedes actualizar, puedes modificar tus cadenas de conexión SQLIte para que contengan el argumento url "?limit_attached=0", que deshabilitará la realización de conexiones a otras bases de datos SQLite. Sólo estarán afectados los usuarios que usen SQLite
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-04-14 CVE Published
- 2023-11-05 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329 | Release Notes | |
| https://www.sqlite.org/lang_attach.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 0.41.0 < 0.41.7 Search vendor "Metabase" for product "Metabase" and version " >= 0.41.0 < 0.41.7" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 0.42.0 < 0.42.4 Search vendor "Metabase" for product "Metabase" and version " >= 0.42.0 < 0.42.4" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 1.41.0 < 1.41.7 Search vendor "Metabase" for product "Metabase" and version " >= 1.41.0 < 1.41.7" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 1.42.0 < 1.42.4 Search vendor "Metabase" for product "Metabase" and version " >= 1.42.0 < 1.42.4" | - |
Affected
| ||||||