Skip to content
Fencer Intel
critical 9.8

CVE-2024-28255 in the critical feed json

Authentication Bypass in OpenMetadata

published 2y ago modified 4mo ago also EUVD-2024-25354

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
73.3%
EPSS 73.3% chance of exploitation in 30 days, percentile 99.4%
public exploits
1
Metasploit

Summary

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.

Patch / fix

  • openmetadata openmetadata 1.2.4

Is CVE-2024-28255 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. First public exploit (Metasploit exploit/linux/http/openmetadata_auth_bypass_rce)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

73.26% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • Metasploit exploit/linux/http/openmetadata_auth_bypass_rce OpenMetadata authentication bypass and SpEL injection exploit chain metasploit exploit, excellent rank, 2024-03-15
  • github.com https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84 referenced PoC, tagged "exploit" by a source, unverified
  • vicarius.io https://www.vicarius.io/vsociety/posts/authentication-bypass-with-path-parameter-in-openmetadata-cve-2024-28255 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • open-metadata OpenMetadata
  • openmetadata openmetadata

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.