Critical · published March 15, 2024
CVSS calls it critical at 9.8. It sits in the 99.5th percentile for exploit probability.
🚨 A sneaky path parameter lets attackers waltz past JWT authentication like a VIP guest at a restricted party! 🔥 Imagine a bouncer at a club who only checks IDs at the front door, but if a guest whispers the right code, they can just stroll in without any checks. That’s what’s happening here—an attacker can craft a path that tricks the API into thinking they’re authorized. If exploited, this vulnerability could allow malicious actors to bypass authentication entirely, gaining access to sensitive endpoints without needing a valid JWT. This means they could manipulate data or execute arbitrary code, leading to a complete compromise of the platform's security! Absolutely devastating!
Imagine a bouncer at a club who only checks IDs at the front door, but if a guest whispers the right code, they can just stroll in without any checks. That’s what’s happening here—an attacker can craft a path that tricks the API into thinking they’re authorized. The flaw in OpenMetadata's `JwtFilter` allows attackers to manipulate request paths to match excluded endpoints, skipping JWT validation and allowing unauthorized access. This can lead to arbitrary SpEL expression injection and further exploitation.
If exploited, this vulnerability could allow malicious actors to bypass authentication entirely, gaining access to sensitive endpoints without needing a valid JWT. This means they could manipulate data or execute arbitrary code, leading to a complete compromise of the platform's security! Absolutely devastating! Upgrade OpenMetadata to version 1.2.4 immediately to patch this vulnerability. Since there are no known workarounds, swift action is essential to safeguard your system. Ensure all paths are validated before processing requests! You've got this! Follow these steps, and you’ll be a security hero in no time! 🦸♂️