CVE-2023-38646
Metabase 0.46.6 Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
30Exploited in Wild
-Decision
Descriptions
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created with a TRIGGER that allows for code execution. We use a sample database for our connection string to prevent corrupting real databases. Successfully tested against Metabase 0.46.6.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-07-21 CVE Reserved
- 2023-07-21 CVE Published
- 2023-07-29 First Exploit
- 2024-08-02 CVE Updated
- 2024-10-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (37)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.metabase.com/blog/security-advisory | 2023-07-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | < 0.43.7.2 Search vendor "Metabase" for product "Metabase" and version " < 0.43.7.2" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | < 1.43.7.2 Search vendor "Metabase" for product "Metabase" and version " < 1.43.7.2" | enterprise |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 0.44.0 < 0.44.7.1 Search vendor "Metabase" for product "Metabase" and version " >= 0.44.0 < 0.44.7.1" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 0.45.0 < 0.45.4.1 Search vendor "Metabase" for product "Metabase" and version " >= 0.45.0 < 0.45.4.1" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 0.46.0 < 0.46.6.1 Search vendor "Metabase" for product "Metabase" and version " >= 0.46.0 < 0.46.6.1" | - |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 1.44.0 < 1.44.7.1 Search vendor "Metabase" for product "Metabase" and version " >= 1.44.0 < 1.44.7.1" | enterprise |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 1.45.0 < 1.45.4.1 Search vendor "Metabase" for product "Metabase" and version " >= 1.45.0 < 1.45.4.1" | enterprise |
Affected
| ||||||
| Metabase Search vendor "Metabase" | Metabase Search vendor "Metabase" for product "Metabase" | >= 1.46.0 < 1.46.6.1 Search vendor "Metabase" for product "Metabase" and version " >= 1.46.0 < 1.46.6.1" | enterprise |
Affected
| ||||||