CVE-2024-28253
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. CompiledRule::validateExpression
is also called from PolicyRepository.prepare
. prepare()
is called from EntityRepository.prepareInternal()
which, in turn, gets called from EntityResource.createOrUpdate()
. Note that even though there is an authorization check (authorizer.authorize()
), it gets called after prepareInternal()
gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to /api/v1/policies
which gets handled by PolicyResource.createOrUpdate()
. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as GHSL-2023-252
. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weaknesses
- CWE-94
- Improper Control of Generation of Code ('Code Injection')
- CVE Status
- PUBLISHED
- CNA
- GitHub, Inc.
- Published Date
-
2024-03-15 20:15:09
(6 months ago) - Updated Date
-
2024-03-17 22:38:29
(6 months ago)