CVE-2023-37470

Summary

CVE-2023-37470 is a remote code execution vulnerability affecting versions of Metabase, an open-source business intelligence platform, prior to 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4. The issue lies in the H2 in-memory database, which this platform supports, as it allows a connection string to include code that is subsequently executed by the embedded database. Malicious users can exploit this vulnerability by injecting executable code through Metabase's database connection process. The platform's validation API was the primary vector for exploitation. The affected versions have been patched by removing the ability to add H2 databases entirely. As a temporary measure, network administrators can prevent these vulnerabilities by blocking the endpoints `POST /api/database`, `PUT /api/database/:id`, and `POST /api/setup/validateuntil`. Metabase users relying on H2 as a file-based database are recommended to migrate to SQLite.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.