CVE-2024-28254

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-78

• https://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionNot Applicable
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L101Product
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L108Product
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-j86m-rrpr-g8gwVendor Advisory
• https://github.com/spring-projects/spring-framework/blob/4e2d3573189b7c0afce62bce29cd915de4077f56/spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpression.java#L106Product
• https://codeql.github.com/codeql-query-help/java/java-spel-expression-injectionNot Applicable
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L101Product
• https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L108Product
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-j86m-rrpr-g8gwVendor Advisory
• https://github.com/spring-projects/spring-framework/blob/4e2d3573189b7c0afce62bce29cd915de4077f56/spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpression.java#L106Product

Published

Mar 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28249Cilium is a networking, observability, and security solution…6.1
• CVE-2024-2825A vulnerability classified as critical has been found in lak…8.8
• CVE-2024-28250Cilium is a networking, observability, and security solution…6.1
• CVE-2024-28251Querybook is a Big Data Querying UI, combining collocated ta…7.3
• CVE-2024-28252CoreWCF is a port of the service side of Windows Communicati…7.5
• CVE-2024-28253OpenMetadata is a unified platform for discovery, observabil…8.8
• CVE-2024-28255OpenMetadata is a unified platform for discovery, observabil…9.8
• CVE-2024-2826A vulnerability classified as problematic was found in laker…8.8
• CVE-2024-28265IBOS v4.5.5 has an arbitrary file deletion vulnerability via…9.1
• CVE-2024-28269ReCrystallize Server 5.10.0.0 allows administrators to uploa…7.2
• CVE-2024-2827A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-28270An issue discovered in web-flash v3.0 allows attackers to re…8.1