Critical · published August 4, 2023
🚨 Imagine your Metabase server suddenly executing malicious code just because a crafty user hit 'connect'! This vulnerability opens the door to remote code execution on versions before 0.43.7.3. 🔥 Think of it like a restaurant letting customers customize their orders without checking the ingredients — one sneaky substitution could lead to a disaster in the kitchen! An attacker could exploit this vulnerability to run any code on your Metabase server, leading to potentially devastating data leaks or server takeovers. This is a full-blown crisis waiting to happen, with your sensitive data at stake!
Think of it like a restaurant letting customers customize their orders without checking the ingredients — one sneaky substitution could lead to a disaster in the kitchen! This vulnerability arises from the embedded H2 database allowing user-supplied connection strings to execute code without proper validation, effectively turning users into unwitting attackers. This means any database connection can be a pathway for remote code execution.
An attacker could exploit this vulnerability to run any code on your Metabase server, leading to potentially devastating data leaks or server takeovers. This is a full-blown crisis waiting to happen, with your sensitive data at stake! To protect your Metabase instance, immediately upgrade to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, or 1.46.6.4. If upgrading isn't possible, block the vulnerable API endpoints at the network level and consider migrating from H2 to SQLite. You've got this! Follow these steps, and your Metabase will be secure in no time! 🛡️