Critical · published March 15, 2024
🚨 A sneaky oversight in OpenMetadata could let attackers slip a malicious request through the back door! 🔥 Think of this like a restaurant where the chef starts cooking a dish based on a patron's order before verifying their reservation — if the order is untrustworthy, they might end up serving a recipe for disaster! An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially gaining full control of your entire metadata repository. This could lead to absolute chaos, with the attacker able to modify, delete, or even exfiltrate sensitive data, making this an absolutely devastating scenario!
Think of this like a restaurant where the chef starts cooking a dish based on a patron's order before verifying their reservation — if the order is untrustworthy, they might end up serving a recipe for disaster! This vulnerability occurs because the authorization check is triggered after sensitive evaluation logic within the `prepareInternal()` method, allowing an attacker to send a well-crafted PUT request to `/api/v1/policies` and execute arbitrary code via a SpEL expression.
An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially gaining full control of your entire metadata repository. This could lead to absolute chaos, with the attacker able to modify, delete, or even exfiltrate sensitive data, making this an absolutely devastating scenario! Immediately upgrade OpenMetadata to version 1.3.1 to patch this critical vulnerability. Since there are no known workarounds, applying this update should be your top priority to keep your systems safe! You've got this! Follow these steps and you'll be securing your metadata like a pro! 🛡️