CVE-2022-24853
Last modified
CVE-2022-24853 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. EPSS estimates a 2.44% chance of exploitation in the next 30 days.
Description
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Metabase | Metabase | >= 0.40.0, < 0.40.8 |
| Metabase | Metabase | >= 0.41.0, < 0.41.7 |
| Metabase | Metabase | >= 0.42.0, < 0.42.4 |
| Metabase | Metabase | >= 1.40.0, < 1.40.8 |
| Metabase | Metabase | >= 1.41.0, < 1.41.7 |
| Metabase | Metabase | >= 1.42.0, < 1.42.4 |
References
- https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38mRelease Notes, Third Party Advisory
- https://secure77.de/metabase-ntlm-relay-attack/Exploit, Third Party Advisory
- https://www.qomplx.com/qomplx-knowledge-ntlm-relay-attacks-explained/Third Party Advisory
- https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38mRelease Notes, Third Party Advisory
- https://secure77.de/metabase-ntlm-relay-attack/Exploit, Third Party Advisory
- https://www.qomplx.com/qomplx-knowledge-ntlm-relay-attacks-explained/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-24853?
How severe is CVE-2022-24853?
How do I fix CVE-2022-24853?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-24847GeoServer is an open source software server written in Java …7.2
- CVE-2022-24848DHIS2 is an information system for data capture, management,…8.8
- CVE-2022-24849DisCatSharp is a Discord API wrapper for .NET. Users of vers…6.5
- CVE-2022-2485Any attempt (good or bad) to log into AutomationDirect Strid…7.5
- CVE-2022-24850Discourse is an open source platform for community discussio…4.3
- CVE-2022-24851LDAP Account Manager (LAM) is an open source web frontend fo…4.8
- CVE-2022-24854Metabase is an open source business intelligence and analyti…8.8
- CVE-2022-24855Metabase is an open source business intelligence and analyti…5.4
- CVE-2022-24856FlyteConsole is the web user interface for the Flyte platfor…7.5
- CVE-2022-24857django-mfa3 is a library that implements multi factor authen…8.8
- CVE-2022-24858next-auth v3 users before version 3.29.2 are impacted. next-…6.1
- CVE-2022-24859PyPDF2 is an open source python PDF library capable of split…5.5
Are you affected by CVE-2022-24853?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST