Metabase Zero-Day SQL Injection Vulnerability Leveraged in Widespread Data Theft Attacks

A critical, unauthenticated SQL injection vulnerability in the popular business intelligence platform Metabase has been actively exploited in zero-day attacks, leading to significant data breaches at multiple organizations, including prominent tech company Framework and online form builder Tally. The vulnerability, affecting Metabase versions 1.58 and above, allows remote attackers to gain administrator access to customer instances, enabling them to steal credentials, read sensitive data, and alter application configurations. Metabase has confirmed that both its cloud-hosted SaaS platform and self-hosted installations are vulnerable and has since released patches to address the flaw.

Unveiling the Zero-Day Exploit

Metabase disclosed the widespread exploitation of this previously unknown security flaw on Thursday, August 8th, 2024. In a stark warning issued by Metabase CEO Sameer Al-Sakran, the company revealed that its Metabase Cloud platform had been compromised through a "0-day" vulnerability. This indicates that the exploit was active and being used by malicious actors before Metabase was aware of its existence or had developed a defense. The vulnerability has been assigned a Critical severity rating, with a maximum CVSS score of 10.0, underscoring the extreme risk it poses.

The nature of the vulnerability is described as an "unauthenticated SQL injection flaw." This means that an attacker does not need any prior credentials or authentication to initiate the exploit. By injecting malicious SQL code into specific input fields within the Metabase application, attackers can manipulate the underlying database. The ultimate consequence of a successful injection is the attainment of full administrator privileges over a compromised customer instance. This level of access grants attackers the ability to perform a wide range of malicious activities.

The Devastating Reach of Administrator Access

With administrator access, attackers can:

• Steal Stored Credentials: This includes usernames and passwords for databases connected to Metabase, potentially granting access to even more sensitive data repositories.
• Read Arbitrary Data: Attackers can access any information stored within or accessible through the connected databases, including customer lists, financial records, intellectual property, and personal identifiable information (PII).
• Export Data: Sensitive information can be exfiltrated from the compromised systems and transferred to attacker-controlled servers.
• Modify Application Configuration: Attackers can alter Metabase settings, potentially disabling security features, creating backdoors, or manipulating how data is presented to legitimate users.
• Disrupt Operations: By altering configurations or deleting data, attackers can cause significant operational disruptions.

Metabase’s official security advisory, available on GitHub, explicitly states: "From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Metabase has confirmed active exploitation of this vulnerability." This confirmation of active exploitation, coupled with the critical severity rating, paints a grim picture of the immediate threat faced by Metabase users.

A Timeline of Compromise and Response

The timeline of events, as pieced together from Metabase’s disclosures and affected customer notifications, suggests a period of active exploitation preceding the public announcement.

• Early August 2024: Attacks begin targeting Metabase instances. Framework reports its instance was accessed by an attacker on August 3rd. Tally also confirms its analytics environment was compromised on August 3rd.
• August 6th, 2024: Metabase notifies Framework that its instance was vulnerable and had been accessed.
• August 8th, 2024: Metabase publicly discloses the zero-day vulnerability and the ongoing attacks in a blog post and security advisory. The company confirms it has blocked the attack endpoints and rolled out a fix.

Metabase has moved swiftly to address the vulnerability. Patches have been released for all affected branches, with specific minimum safe release versions recommended:

• 0.58.24
• 0.59.21
• 0.60.17
• 0.61.11
• 0.62.9
• 0.63.5

For Metabase Cloud users, the company has automatically upgraded and patched their instances. However, organizations operating self-hosted Metabase installations are required to manually apply the updates.

Organizations Grappling with the Fallout

Several high-profile organizations have already come forward to confirm the impact of this breach on their operations and customer data.

Framework Computer: The laptop manufacturer Framework confirmed that customer information was stolen after its Metabase instance was compromised. In a breach notification shared with BleepingComputer, Framework detailed the types of data exposed:

• Full names
• Email addresses
• Login IP addresses
• Billing and shipping address information
• Phone numbers
• Company names

For "Framework for Business" customers, the compromised data may have also included company name, phone number, VAT (Value Added Tax) identification number, EIN (Employer Identification Number), and billing email address. Framework’s notification stated that Metabase alerted them to the vulnerability and the breach on August 6th, with the exploitation occurring on August 3rd. This indicates a rapid and effective attack following the discovery of the zero-day.

Tally: The popular online form builder, Tally, also alerted its users to a compromise of its Metabase analytics environment on August 3rd. Tally stated that attackers gained access to customer email addresses and their passwords, though the passwords were in a "cryptographic hash" format. The company emphasized that these hashes are one-way, meaning they cannot be directly converted back into readable passwords. Crucially, Tally assured users that their forms and the submitted answers were stored separately and were not accessed during this incident. However, questions remain regarding the specific hashing algorithm used and whether the exposed password hashes were "salted," a security practice that further strengthens password protection against brute-force attacks.

LexisNexis: While not explicitly confirming a direct compromise of its own Metabase instance, LexisNexis issued a warning to customers about a service disruption affecting its Diligence, Metabase API, and Newsdesk applications. The company stated that unusual activity was detected on servers managed by a third-party vendor. To contain the issue, LexisNexis made the immediate decision to disconnect from these third-party systems, leading to the unavailability of the affected applications. The company is working with a cybersecurity forensic firm to investigate, and it remains unclear at this stage whether customer data was exposed. However, the mention of the "Metabase API" being impacted suggests a potential indirect connection or dependency on a compromised Metabase infrastructure.

Mitigation and Remediation Strategies

Metabase has provided detailed guidance for organizations to mitigate the immediate risks and to investigate potential compromises.

Immediate Actions for Self-Hosted Installations:

1. Upgrade Immediately: Organizations running self-hosted Metabase instances are urged to update to one of the patched versions as soon as possible.
2. Revoke Active User Sessions: All active user sessions should be terminated to force re-authentication and prevent any lingering unauthorized access.
3. Review API Keys and Administrator Accounts: A thorough review of all API keys and administrator accounts is recommended to identify any unauthorized creations or modifications.
4. Rotate Credentials: Credentials for all databases connected to Metabase should be rotated to invalidate any potentially stolen credentials.
5. Inspect Logs and Query History: Administrators should meticulously examine system logs and query history for any signs of suspicious activity or unauthorized access.

Temporary Workaround:

For organizations unable to upgrade immediately, Metabase advises temporarily blocking access to the endpoint /api/session/reset_password. This endpoint is reportedly involved in the exploit chain.

Identifying Compromise:

Metabase has outlined specific indicators of compromise (IoCs) that can be found in system logs. Attacks can often be identified by a POST request to /api/session/reset_password that returns a 400 status code, followed by a successful GET request to /api/user/current. The company cautions that system logs showing these entries have likely been compromised themselves, meaning attackers may have attempted to cover their tracks.

Broader Implications for Data Security

The Metabase vulnerability underscores several critical points about modern data security:

• The Pervasiveness of Business Intelligence Tools: Tools like Metabase are increasingly central to business operations, acting as gateways to vast amounts of sensitive data. Their security is paramount.
• The Evolving Threat Landscape: Zero-day exploits continue to be a potent weapon for cybercriminals, highlighting the constant need for vigilance and rapid response from software vendors.
• The Interconnectedness of Supply Chains: As seen with LexisNexis, vulnerabilities in third-party vendors can have cascading effects, impacting multiple organizations and their customers.
• The Importance of Proactive Security Measures: While patches are essential, organizations must also implement robust security practices, including regular security audits, credential rotation, and comprehensive logging and monitoring.
• The Value of Data: The direct targeting of customer data by attackers in the Framework and Tally breaches emphasizes that PII and sensitive business information remain highly prized targets. The fact that password hashes were exposed, even if one-way, presents a risk, as sophisticated attackers can attempt to crack them.

The Metabase SQL injection vulnerability represents a significant security incident with far-reaching consequences. The swift action by Metabase to patch the flaw is commendable, but the ongoing efforts by affected organizations to assess and remediate the damage will continue for some time. This event serves as a potent reminder for all organizations relying on data analytics platforms to prioritize their security posture and to be prepared for the inevitable emergence of new threats. The race is on for defenders to patch systems and for affected parties to understand the full extent of the data exposed, while attackers continue to probe for new vulnerabilities.