Summary

An unauthenticated attacker can inject arbitrary SQL into the Metabase application database using a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. With only the public link UUID, which is part of the shared URL by design, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Public sharing is enabled by default, so publishing a link is the only setup required.

Remediation

Upgrade to a patch corresponding to your Metabase major version as soon as possible. As a temporary workaround, disable public sharing, or unpublish public links that expose field-filter parameters.

If you have publicly shared dashboards or cards with field-filter parameters, then please do the following after you upgrade:

1. Revoke all active user sessions by accessing the Metabase application database and running TRUNCATE TABLE core_session.
2. Review your API keys and delete any unrecognized keys.
3. Review administrator accounts for any unexpected changes.
4. Rotate credentials for any of the connected databases.
5. Review data warehouse logs for any sign of unauthorized access.
6. Review Metabase activity and query history for unexpected or unauthorized activity.

Versions with the fix

v63.5

OSS: jar | docker
EE: jar | docker

v62.9

OSS: jar·docker
EE: jar·docker

v61.11

OSS: jar | docker
EE: jar | docker

v60.17

OSS: jar | docker
EE: jar | docker

v59.21

OSS: jar | docker
EE: jar | docker

v58.24

OSS: jar | docker
EE: jar | docker