CVE-2024-28253

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-94

• https://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionNot Applicable
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693Product
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219Product
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365Product
• https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113Product
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6grVendor Advisory
• https://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionNot Applicable
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693Product
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219Product
• https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365Product
• https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113Product
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6grVendor Advisory

Published

Mar 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28248Cilium is a networking, observability, and security solution…7.2
• CVE-2024-28249Cilium is a networking, observability, and security solution…6.1
• CVE-2024-2825A vulnerability classified as critical has been found in lak…8.8
• CVE-2024-28250Cilium is a networking, observability, and security solution…6.1
• CVE-2024-28251Querybook is a Big Data Querying UI, combining collocated ta…7.3
• CVE-2024-28252CoreWCF is a port of the service side of Windows Communicati…7.5
• CVE-2024-28254OpenMetadata is a unified platform for discovery, observabil…8.8
• CVE-2024-28255OpenMetadata is a unified platform for discovery, observabil…9.8
• CVE-2024-2826A vulnerability classified as problematic was found in laker…8.8
• CVE-2024-28265IBOS v4.5.5 has an arbitrary file deletion vulnerability via…9.1
• CVE-2024-28269ReCrystallize Server 5.10.0.0 allows administrators to uploa…7.2
• CVE-2024-2827A vulnerability, which was classified as critical, has been …8.8