#VU78778 Input validation error in Metabase - CVE-2023-37470
Vulnerability identifier: #VU78778
Vulnerability risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-37470
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Metabase
Client/Desktop applications /
Office applications
Vendor: Metabase
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input within H2 connection strings. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Metabase: 0.9-final - 0.9.3, 0.10.0 - 0.10.4.1, 0.11.0 - 0.11.3, 0.12.0-test - 0.12.1, 0.13.0 - 0.13.3, 0.14.0 - 0.14.1, 0.15.0 - 0.15.1, 0.16.0 - 0.16.1, 0.17.0 - 0.17.1, 0.18.0 - 0.18.1, 0.19.0 - 0.19.3, 0.20 - 0.20.3, 0.21 - 0.21.1, 0.22 - 0.22.2, 0.23 - 0.23.1, 0.24 - 0.24.2, 0.25 - 0.25.2, 0.26 - 0.26.2, 0.27 - 0.27.2, 0.28 - 0.28.6, 0.29 - 0.29.3, 0.30.0 rc - 0.30.4, 0.31.0 RC1 - 0.31.3, 0.32.0 RC - 0.32.10, 0.33.0 RC1 - 0.33.7.3, 0.34.0 rc1 - 0.34.3, 0.35.0 rc1 - 0.35.6, 0.36.0-snapshot - 0.36.12, 0.37.0 - 0.37.12, 0.38.0 - 0.38.6, 0.39.0 - 0.39.7, 0.40.0 - 0.40.8, 0.41.0 - 0.41.9, 0.42.0 - 0.42.6, 0.43.0 - 0.43.7.3, 0.44.0 - 0.44.7.3, 0.45.0 - 0.45.4.3, 0.46.0 - 0.46.6.3, 1.37.0.2 - 1.37.12, 1.38.0 - 1.38.6, 1.39.0 - 1.39.7, 1.40.0 - 1.40.8, 1.41.0 - 1.41.9, 1.42.0 - 1.42.6, 1.43.0 - 1.43.7.2, 1.44.0 - 1.44.7.2, 1.45.0 - 1.45.4.2, 1.46.0 - 1.46.6.3
External links
https://github.com/metabase/metabase/security/advisories/GHSA-p7w3-9m58-rq83
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
